Re: [PATCH v4] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write
"Martin K. Petersen" <[email protected]>
| Newsgroups | gmane.linux.kernel.stable,gmane.linux.scsi,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 12 Jul 2026 20:37:39 +0200, Ibrahim Hashimov wrote:
> resp_report_zones() sizes the reply buffer from the CDB allocation
> length. The v3 fix rounds alloc_len up with ALIGN() before deriving the
> descriptor count:
>
> rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -
> RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);
> arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);
>
> [...]
Applied to 7.2/scsi-fixes, thanks!
[1/1] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write
https://git.kernel.org/mkp/scsi/c/93dde0bf2f39
--
Martin K. Petersen