[PATCH] scsi: sd: bound MODE SENSE offset in sd_read_app_tag_own()

[Jay Vadayath]

sd_read_app_tag_own() issues a MODE SENSE(10) against the target and
then indexes into the returned buffer at
	offset = data.header_length + data.block_descriptor_length;
buffer[offset] and buffer[offset + 4]. data.block_descriptor_length is
copied verbatim from the untrusted device response and can be as large
as 65535, so with a hostile response the offset can point well past the
36-byte SD_BUF_SIZE buffer the caller passes in, producing a
slab-out-of-bounds read.

KASAN report from an emulated USB mass storage device (raw-gadget +
dummy_hcd) returning a MODE SENSE(10) response with
block_descriptor_length = 600:

  BUG: KASAN: slab-out-of-bounds in sd_revalidate_disk+0x863f/0x8940
  Read of size 1 at addr ffff88800634de60 by task kworker/u8:0/12
  Call Trace:
   dump_stack_lvl+0x64/0x80
   print_report+0xce/0x620
   kasan_report+0xec/0x120
   sd_revalidate_disk+0x863f/0x8940
   sd_probe+0x79f/0xf20
   really_probe+0x1c8/0x950
   __driver_probe_device+0x1a5/0x430
   driver_probe_device+0x45/0xd0
   __device_attach_driver+0x156/0x230
   bus_for_each_drv+0x10f/0x190
   __device_attach+0x18e/0x3b0
   device_initial_probe+0x78/0xa0
   bus_probe_device+0x57/0x130

Reject responses whose mode page offset does not leave room for the
five bytes of the ATO mode page that this function subsequently
touches, and log the rejection.

This bug was discovered by Artiphishell's vTriage pipeline, which
generated a userspace raw-gadget reproducer that reliably triggers the
KASAN report on an unpatched kernel. The fix below was drafted with the
Claude coding assistant; a userspace reproducer is available on
request.

Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Jay Vadayath <jay@xxxxxxxxxxxxxxxx>

---
 drivers/scsi/sd.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -3366,6 +3366,18 @@ static void sd_read_app_tag_own(struct scsi_disk *sdkp, unsigned char *buffer)
 	}

 	offset = data.header_length + data.block_descriptor_length;
+
+	/*
+	 * block_descriptor_length is taken verbatim from the (untrusted)
+	 * device response and can be as large as 65535, so the computed
+	 * offset may point well past the SD_BUF_SIZE buffer that only holds
+	 * the 36 bytes we asked for.  Validate it before dereferencing to
+	 * avoid a slab out-of-bounds read.
+	 */
+	if (offset < 0 || offset + 5 >= 36) {
+		sd_first_printk(KERN_ERR, sdkp, "ATO mode page too long\n");
+		return;
+	}

 	if ((buffer[offset] & 0x3f) != 0x0a) {
 		sd_first_printk(KERN_ERR, sdkp, "ATO Got wrong page\n");