[lvc-project] Fwd: [PATCH] firmware_loader: prevent integer overflow in firmware_loading_timeout()

[Fedor Pchelkin]

On Fri, 04. Jul 16:30, Sergey Shtylyov wrote:
> Прошу прощения - забыл добавить lvc-project в CC...
> 
> -------- Forwarded Message --------
> Subject: [PATCH] firmware_loader: prevent integer overflow in firmware_loading_timeout()
> Date: Thu, 3 Jul 2025 23:38:33 +0300
> From: Sergey Shtylyov <s.shtylyov at omp.ru>
> Organization: Open Mobile Platform
> To: Luis Chamberlain <mcgrof at kernel.org>, Russ Weight <russ.weight at linux.dev>, Danilo Krummrich <dakr at kernel.org>, Greg Kroah-Hartman <gregkh at linuxfoundation.org>, Rafael J. Wysocki <rafael at kernel.org>, linux-kernel at vger.kernel.org
> 
> In firmware_loading_timeout(), *int* result of __firmware_loading_timeout()
> multiplied by HZ might overflow before being implicitly cast to *long* when
> being returned. Rewrite the function using check_mul_overflow() and capping
> the result at LONG_MAX on actual overflow...
> 
> Found by Linux Verification Center (linuxtesting.org) with the Svace static
> analysis tool.
> 
> Signed-off-by: Sergey Shtylyov <s.shtylyov at omp.ru>
> Cc: stable at vger.kernel.org
> 


Спасибо за патчи!

Но для целенаправленного добавления текущего патча на firmware_loader и
похожего с таймаутами на nfs4 в LVC-ветки вроде как нет особых причин. В
Свейсере сработки помечены как Minor, насколько вижу.

> ---
> The patch is against the commit 78f4e737a53e1163ded2687a922fce138aee73f5 in
> Linus Torvalds' linux.git repo -- that's the most recent commit I could get
> (git {fetch,pull} from git.kernel stopped working for me first with git://
> and then with https:// protocol)...
> 
>  drivers/base/firmware_loader/fallback.c |    9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> Index: linux/drivers/base/firmware_loader/fallback.c
> ===================================================================
> --- linux.orig/drivers/base/firmware_loader/fallback.c
> +++ linux/drivers/base/firmware_loader/fallback.c
> @@ -35,8 +35,13 @@ void fw_fallback_set_default_timeout(voi
>  
>  static long firmware_loading_timeout(void)
>  {
> -	return __firmware_loading_timeout() > 0 ?
> -		__firmware_loading_timeout() * HZ : MAX_JIFFY_OFFSET;
> +	long timeout;
> +
> +	if (__firmware_loading_timeout() <= 0)
> +		return MAX_JIFFY_OFFSET;
> +	if (check_mul_overflow(__firmware_loading_timeout(), HZ, &timeout))
> +		return LONG_MAX;
> +	return timeout;
>  }
>  
>  static inline int fw_sysfs_wait_timeout(struct fw_priv *fw_priv,  long timeout)