Re: [PATCH v4] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write

[Bart Van Assche]

On 7/12/26 11:37 AM, Ibrahim Hashimov wrote:
> Clamp rep_max_zones to devip->nr_zones. The loop already stops at
> sdebug_capacity (after nr_zones zones), so a report can never hold more
> than nr_zones descriptors; the clamp does not change the report, it
> only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device
> property that can never reach 0x100000000.

Reviewed-by: Bart Van Assche <bvanassche@xxxxxxx>