Description
In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat: [ 366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33 [ 366.021089] -9223372036854775808 - 346321 cannot be represented in type '__s64' (aka 'long long') [ 366.025894] program syz-executor.4 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 366.027502] CPU: 5 PID: 28472 Comm: syz-executor.7 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 [ 366.027512] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 366.027518] Call Trace: [ 366.027523] <TASK> [ 366.027533] dump_stack_lvl+0x93/0xd0 [ 366.027899] handle_overflow+0x171/0x1b0 [ 366.038787] ata1.00: invalid multi_count 32 ignored [ 366.043924] cdrom_ioctl+0x2c3f/0x2d10 [ 366.063932] ? __pm_runtime_resume+0xe6/0x130 [ 366.071923] sr_block_ioctl+0x15d/0x1d0 [ 366.074624] ? __pfx_sr_block_ioctl+0x10/0x10 [ 366.077642] blkdev_ioctl+0x419/0x500 [ 366.080231] ? __pfx_blkdev_ioctl+0x10/0x10 ... Historically, the signed integer overflow sanitizer did not work in the kernel due to its interaction with `-fwrapv` but this has since been changed [1] in the newest version of Clang. It was re-enabled in the kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow sanitizer"). Let's rearrange the check to not perform any arithmetic, thus not tripping the sanitizer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
67f1e027c27054e641584655020a417eaac9cb3a to < 0c97527e916054acc4a46ffb02842988acb2e92baffected67f1e027c27054e641584655020a417eaac9cb3a to < 3ee21e14c8c329168a0b66bab00ecd18f5d0dee3affected67f1e027c27054e641584655020a417eaac9cb3a to < e809bc112712da8f7e15822674c6562da6cdf24caffected67f1e027c27054e641584655020a417eaac9cb3a to < efb905aeb44b0e99c0e6b07865b1885ae0471ebfaffected
Linux Linux
Default version status: affected
5.16affected0 to < 5.16unaffected6.1.98 to ≤ 6.1.*unaffected6.6.39 to ≤ 6.6.*unaffected6.9.9 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0c97527e916054acc4a46ffb02842988acb2e92b ↗
- https://git.kernel.org/stable/c/3ee21e14c8c329168a0b66bab00ecd18f5d0dee3 ↗
- https://git.kernel.org/stable/c/e809bc112712da8f7e15822674c6562da6cdf24c ↗
- https://git.kernel.org/stable/c/efb905aeb44b0e99c0e6b07865b1885ae0471ebf ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗