SG_SET_TIMEOUT accepts a signed int in USER_HZ units. The sg character device rejects negative values and limits positive values so the converted timeout fits its destination field. The block SCSI and BSG paths instead pass the value to clock_t_to_jiffies(), which accepts an unsigned long, and store the result in an unsigned int. Negative values are converted into large unsigned timeouts. On 64-bit systems, large positive values can also exceed UINT_MAX after conversion and are truncated on assignment. With HZ=1000, for example, 429496730 clock ticks become 4294967300 jiffies and are stored as 4 jiffies. On 32-bit systems, an overflowing conversion becomes ULONG_MAX, which is an unsafe relative interval for the block timer comparisons. Reject negative values with -EIO, matching drivers/scsi/sg.c. Saturate the converted value at the smaller of the destination field limit and MAX_JIFFY_OFFSET. This preserves successful ioctl behavior while avoiding both narrowing wraparound and an unsafe 32-bit timer interval. The block SCSI behavior predates Git history. BSG has exposed the same behavior since it was introduced. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 3d6392cfbd7d ("bsg: support for full generic block layer SG v3") Cc: stable@vger.kernel.org Reported-by: Bart Van Assche Link: https://lore.kernel.org/r/9321a59c-c560-4742-8b71-5b0ec1f30c2f@acm.org Signed-off-by: Yingjie Wang --- Changes in v2: - Add the pre-Git Fixes tag for the block SCSI path. - Saturate large positive conversions at the smaller of UINT_MAX and MAX_JIFFY_OFFSET instead of allowing narrowing wraparound or an unsafe 32-bit timer interval. - Expand the commit message and boundary testing for the positive and 32-bit cases. Tested on x86-64 with HZ=1000 through both /dev/sr0 and BSG. Values 0, 1, and 429496729 round-trip unchanged; 429496730 and INT_MAX saturate to 429496729 USER_HZ ticks; -5 returns EIO. Zero-timeout SG_IO requests still complete after setting the timeout to 1. Also tested on an actual i386 HZ=1000 QEMU kernel through both /dev/sr0 and BSG. Values 0, 1, and 107374182 round-trip unchanged; 107374183, 429496729, and INT_MAX saturate to 107374182 USER_HZ ticks; -5 returns EIO. v1: https://lore.kernel.org/r/20261017084547.2880694-1-x-professor@outlook.com block/bsg.c | 6 +++++- drivers/scsi/scsi_ioctl.c | 12 +++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/block/bsg.c b/block/bsg.c index 82aaf3cee5825..632b3f6d98b29 100644 --- a/block/bsg.c +++ b/block/bsg.c @@ -132,7 +132,11 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg) case SG_SET_TIMEOUT: if (get_user(val, intp)) return -EFAULT; - bd->timeout = clock_t_to_jiffies(val); + if (val < 0) + return -EIO; + bd->timeout = min_t(unsigned long, clock_t_to_jiffies(val), + min_t(unsigned long, UINT_MAX, + MAX_JIFFY_OFFSET)); return 0; case SG_GET_TIMEOUT: return jiffies_to_clock_t(bd->timeout); diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c index c14f81403a09e..8277e6adf497e 100644 --- a/drivers/scsi/scsi_ioctl.c +++ b/drivers/scsi/scsi_ioctl.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -195,10 +196,15 @@ static int sg_set_timeout(struct scsi_device *sdev, int __user *p) { int timeout, err = get_user(timeout, p); - if (!err) - sdev->sg_timeout = clock_t_to_jiffies(timeout); + if (err) + return err; + if (timeout < 0) + return -EIO; - return err; + sdev->sg_timeout = + min_t(unsigned long, clock_t_to_jiffies(timeout), + min_t(unsigned long, UINT_MAX, MAX_JIFFY_OFFSET)); + return 0; } static int sg_get_reserved_size(struct scsi_device *sdev, int __user *p) base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da -- 2.43.0