Re: [PATCH] scsi: sd_zbc: cap zone report count by buffer size

[Martin K. Petersen (Oracle)]

On Wed, 28 Oct 2026 14:16:51 +0800, Boyan Liu wrote:

> sd_zbc_report_zones() limits descriptor parsing to the requested zone
> count and the device-reported ZONE LIST LENGTH, but not to the number of
> descriptors that fit in the allocated report buffer. A malicious or
> malfunctioning device can report an oversized length and cause
> out-of-bounds reads while the descriptors are parsed:
> 
>     BUG: KASAN: slab-out-of-bounds in sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256)
>     Read of size 8 at addr ffff88802c8d2610 by task kworker/u8:2/37
>     Call Trace:
>      sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256)
>      blk_revalidate_disk_zones (block/blk-zoned.c:2354)
>      sd_zbc_revalidate_zones (drivers/scsi/sd_zbc.c:566)
>      sd_revalidate_disk (drivers/scsi/sd.c:3898)
>      sd_probe (drivers/scsi/sd.c:4101)
> 
> [...]

Applied to 7.4/scsi-fixes, thanks!

[1/1] scsi: sd_zbc: cap zone report count by buffer size
      https://git.kernel.org/mkp/scsi/c/612293fb469c

-- 
Martin K. Petersen