Re: [PATCH v4 1/2] block: fix zones_cond out-of-bounds write on zone report

[Damien Le Moal <dlemoal@kernel.org>]

On 2026/09/17 9:28, Martin K. Petersen (Oracle) wrote:
> On Wed, 16 Sep 2026 21:58:21 +0800, ZHOU Jiaxiang wrote:
> 
>> blk_revalidate_disk_zones() sizes the zones_cond array from the disk
>> capacity and zone size, but the index used by blk_revalidate_zone_cond()
>> comes from the device-driven report_zones() walk and is never checked
>> against the array size. A device reporting more zones than fit the
>> array makes blk_zone_set_cond() write out of bounds.
>>
>> One way to reach this is a zone count exceeding 32 bits: both
>> blk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones
>> are unsigned int, so a disk advertising more than UINT_MAX zones (e.g.
>> 2^32 + 1024 zones of one 512-byte logical block) gets its zone count
>> truncated to a small value, undersizing the array while the report
>> walk keeps counting upward.
>>
>> [...]
> 
> Applied to 7.3/scsi-fixes, thanks!
> 
> [1/2] block: fix zones_cond out-of-bounds write on zone report
>       https://git.kernel.org/mkp/scsi/c/7c431d61b69a
> [2/2] scsi: sd_zbc: reject disks with too many zones
>       https://git.kernel.org/mkp/scsi/c/b6ec0f797459
> 

I just asked about this :)
We will have a conflict in Linux-next with this unless Jens does a rebase of
block/for-next.

-- 
Damien Le Moal
Western Digital Research