loop: Check for overflow while configuring loop

In the Linux kernel, the following vulnerability has been resolved:

loop: Check for overflow while configuring loop

The userspace can configure a loop using an ioctl call, wherein

a configuration of type loop_config is passed (see lo_ioctl()'s

case on line 1550 of drivers/block/loop.c). This proceeds to call

loop_configure() which in turn calls loop_set_status_from_info()

(see line 1050 of loop.c), passing &config->info which is of type

loop_info64*. This function then sets the appropriate values, like

the offset.

loop_device has lo_offset of type loff_t (see line 52 of loop.c),

which is typdef-chained to long long, whereas loop_info64 has

lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).

The function directly copies offset from info to the device as

follows (See line 980 of loop.c):

lo->lo_offset = info->lo_offset;

This results in an overflow, which triggers a warning in iomap_iter()

due to a call to iomap_iter_done() which has:

WARN_ON_ONCE(iter->iomap.offset > iter->pos);

Thus, check for negative value during loop_set_status_from_info().

Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e