Re: [PATCH v11 06/13] scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets

[Damien Le Moal <dlemoal@kernel.org>]

On 2026/09/29 10:25, Niklas Cassel wrote:
> resp_write_scat() computes the length of an LBA range in bytes as a
> 32-bit product, num_by = num * lb_size, and adds it to sg_off, the
> 32-bit offset of the next range in the data-out buffer. The product
> wraps for a range of 4 GiB or more, which check_device_access_params()
> allows once the store is that large, and sg_off wraps once the ranges
> add up to 4 GiB, which neither their number nor their overlap prevents.
> The ranges that follow are then written from the wrong offset in the
> buffer.
> 
> Make num_by and sg_off 64-bit, and pass do_device_access() sg_off
> capped at the length of the buffer. An offset at the end of the buffer
> copies nothing, and sg_copy_buffer(), which takes it as an off_t, is
> never given one larger than the buffer that it copies.
> 
> Assisted-by: LLM
> Fixes: 481b5e5c7949 ("scsi: scsi_debug: add resp_write_scat function")
> Signed-off-by: Niklas Cassel <cassel@kernel.org>

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>


-- 
Damien Le Moal
Western Digital Research