Re: [PATCH] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Rejecting a REPORT ZONES command with an allocation length smaller than the header size (64 bytes) violates SCSI specifications and breaks legitimate host queries.
--

--- Patch [1]: [PATCH] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write ---
commit e364d5684dfdc126ea92154dab5b52f73d6c269d
Author: Ibrahim Hashimov <security@auditcode.ai>

scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write

This commit adds a check in resp_report_zones() to reject a report zones
command if the allocation length is smaller than the 64-byte header size.
This is intended to fix an underflow and subsequent out-of-bounds write
when calculating rep_max_zones.

> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
> index 9d1c9c41d0f99..2fa887c65b61b 100644
> --- a/drivers/scsi/scsi_debug.c
> +++ b/drivers/scsi/scsi_debug.c

[ ... ]

> @@ -5911,6 +5911,11 @@ static int resp_report_zones(struct scsi_cmnd *scp,
>  		return check_condition_result;
>  	}
>  
> +	if (alloc_len < RZONES_DESC_HD) {
> +		mk_sense_invalid_fld(scp, SDEB_IN_CDB, 10, -1);
> +		return check_condition_result;
> +	}
> +

[Severity: Medium]
Does rejecting the command here when alloc_len < RZONES_DESC_HD violate the
SCSI specifications?

The SPC-5 and ZBC standards mandate that allocation length truncation is not
an error. Host applications may probe the zone list length by sending a
report zones command with a small allocation length (between 1 and 63 bytes)
before allocating a full buffer.

Will returning a check condition (invalid field in CDB) break these
legitimate host queries?

>  	rep_max_zones = (alloc_len - 64) >> ilog2(RZONES_DESC_HD);
>  
>  	arr = kzalloc(alloc_len, GFP_ATOMIC | __GFP_NOWARN);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709150631.45018-1-security@auditcode.ai?part=1