Re: [PATCH v4] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write

"Martin K. Petersen" <[email protected]> Tue, 28 Jul 2026 22:56:17 -0400

Newsgroups	org.kernel.vger.linux-scsi,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID	<[email protected]>

On Sun, 12 Jul 2026 20:37:39 +0200, Ibrahim Hashimov wrote:

> resp_report_zones() sizes the reply buffer from the CDB allocation
> length. The v3 fix rounds alloc_len up with ALIGN() before deriving the
> descriptor count:
> 
> 	rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -
> 			 RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);
> 	arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);
> 
> [...]

Applied to 7.2/scsi-fixes, thanks!

[1/1] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write
      https://git.kernel.org/mkp/scsi/c/93dde0bf2f39

-- 
Martin K. Petersen