Re: [PATCH] scsi: target: fix integer overflow in UNMAP bounds check
From: James Bottomley
Date: Wed Mar 04 2026 - 12:08:10 EST
On Wed, 2026-03-04 at 23:42 +0800, Junrui Luo wrote:
> sbc_execute_unmap() checks lba + range does not exceed the device
> capacity, but does not guard against lba + range wrapping around on
> 64-bit overflow.
What's the theory about how this could occur and the problem it causes?
range is a u32 so lba would have to have all 1's in the upper 32 bits
for this to happen (i.e. be a 15 ExB device). Plus do we even care?
If we send an unmap with lba and range that wraps 64 bits then the
device should error or truncate it anyway, shouldn't it?
Regards,
James