Re: [PATCH v3] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write

[Ibrahim Hashimov <security@auditcode.ai>]

On 7/10/26, Bart Van Assche wrote:
> Ibrahim, do you plan to address this finding?

Yes -- addressed in v4, which I will send shortly. The v3 ALIGN() can
round an alloc_len near U32_MAX up to 0x100000000, and on 32-bit that
4 GB arr_len truncates to 0 in kzalloc()'s size_t, returning
ZERO_SIZE_PTR and slipping past the !arr check as the bot noted.

v4 clamps rep_max_zones to devip->nr_zones, so arr_len is bounded by
the real zone count and can never reach 0x100000000 or truncate on
32-bit. The descriptor loop already stops at sdebug_capacity, so the
clamp does not change any report -- it is purely an additive bound, and
Damien's ALIGN sizing is untouched.

Thanks for catching the 32-bit corner.

Ibrahim