Re: [PATCH v4 1/2] block: fix zones_cond out-of-bounds write on zone report

[Damien Le Moal <dlemoal@kernel.org>]

On 2026/09/16 20:58, ZHOU Jiaxiang wrote:
> blk_revalidate_disk_zones() sizes the zones_cond array from the disk
> capacity and zone size, but the index used by blk_revalidate_zone_cond()
> comes from the device-driven report_zones() walk and is never checked
> against the array size. A device reporting more zones than fit the
> array makes blk_zone_set_cond() write out of bounds.
> 
> One way to reach this is a zone count exceeding 32 bits: both
> blk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones
> are unsigned int, so a disk advertising more than UINT_MAX zones (e.g.
> 2^32 + 1024 zones of one 512-byte logical block) gets its zone count
> truncated to a small value, undersizing the array while the report
> walk keeps counting upward.
> 
> Check the index against the array size before storing the zone
> condition, and refuse to revalidate when the zone count does not fit
> 32 bits.
> 
> Fixes: 6e945ffb6555 ("block: use zone condition to determine conventional zones")
> Signed-off-by: ZHOU Jiaxiang <me@fxti.xyz>
> Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

This review stands if this is applied as a fix to the current code. However,
applying this will create a conflict with the changes in this area that are
queued in block/for-bext.

Jens,

How do you want to proceed? Applying this as a fix and do a rebase of
block/for-next? Or rebase this on block/for-next ?

-- 
Damien Le Moal
Western Digital Research