block: fix overflow in blk_ioctl_discard()

JIRA: https://issues.redhat.com/browse/RHEL-39813
CVE: CVE-2024-36917

commit 22d24a5
Author: Li Nan <linan122@huawei.com>
Date:   Fri Mar 29 09:23:19 2024 +0800

    block: fix overflow in blk_ioctl_discard()

    There is no check for overflow of 'start + len' in blk_ioctl_discard().
    Hung task occurs if submit an discard ioctl with the following param:
      start = 0x80000000000ff000, len = 0x8000000000fff000;
    Add the overflow validation now.

    Signed-off-by: Li Nan <linan122@huawei.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Link: https://lore.kernel.org/r/20240329012319.2034550-1-linan666@huaweicloud.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Ming Lei <ming.lei@redhat.com>

Author: Ming Lei

block/ioctl.c

@@ -89,7 +89,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode,
 		unsigned long arg)
 {
 	uint64_t range[2];
-	uint64_t start, len;
+	uint64_t start, len, end;
 	struct inode *inode = bdev->bd_inode;
 	int err;
 
@@ -110,7 +110,8 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode,
 	if (len & 511)
 		return -EINVAL;
 
-	if (start + len > bdev_nr_bytes(bdev))
+	if (check_add_overflow(start, len, &end) ||
+	    end > bdev_nr_bytes(bdev))
 		return -EINVAL;
 
 	filemap_invalidate_lock(inode->i_mapping);