minmax: scsi: fix mis-use of 'clamp()' in sr.c
authorLinus Torvalds <torvalds@linux-foundation.org>
Mon, 29 Jul 2024 00:06:20 +0000 (17:06 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Mon, 29 Jul 2024 00:06:20 +0000 (17:06 -0700)
commit9f499b8c791d2983c0a31a543c51d1b2f15e8755
tree061fcd36991e93a95a0550763b0a560d9a1a6798
parent1a251f52cfdc417c84411a056bc142cbd77baef4
minmax: scsi: fix mis-use of 'clamp()' in sr.c

While working on simplifying the minmax functions, and avoiding
excessive macro expansion, it turns out that the sr.c use of the
'clamp()' macro has the arguments the wrong way around.

The clamp logic is

val = clamp(in, low, high);

and it returns the input clamped to the low/high limits. But sr.c ddid

speed = clamp(0, speed, 0xffff / 177);

which clamps the value '0' to the range '[speed, 0xffff / 177]' and ends
up being nonsensical.

Happily, I don't think anybody ever cared.

Fixes: 9fad9d560af5 ("scsi: sr: Fix unintentional arithmetic wraparound")
Cc: Justin Stitt <justinstitt@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/scsi/sr_ioctl.c