Re: [PATCH v2] scsi: scsi_debug: fix REPORT ZONES alloc_len underflow OOB write

[Ibrahim Hashimov <security@auditcode.ai>]

On 2026/07/10 09:58, Damien Le Moal wrote:
> Yes, but this only partly address the issue. E.g. if the command has an
> allocation length of 64+32, rep_max_zones will incorrectly be 0, leaving
> the 32B after the header unfilled. Sure, that is a "useless" case since no
> one wants a partial zone descriptor. But the SCSI specs allow this, so
> let's do it correctly.
>
> I have a patch in my local queue that I was about to send to fix this, but
> you where faster :) What I did is:
> [...]

Thanks Damien, that makes sense. v3 adopts your ALIGN-based sizing, so a
partial trailing zone descriptor is now built and returned correctly
(Suggested-by: you).

While verifying it I noticed one corner in that snippet: ALIGN(alloc_len, 64)
and the 64 * (rep_max_zones + 1) size product are both evaluated in 32-bit.
alloc_len is the full 32-bit CDB allocation length, so a value just below
U32_MAX (e.g. 0xFFFFFFF0) wraps the aligned length and the size back down to a
tiny/zero value: kzalloc() then returns a ZERO_SIZE_PTR / tiny buffer while
rep_max_zones is huge, which reintroduces the same out-of-bounds write. v3
does the ALIGN and the size computation in 64-bit (cast alloc_len to u64, u64
block size), so that case just fails the large allocation and returns a check
condition instead.

Verified under KASAN: alloc_len=96 now returns the header plus a 32-byte
partial descriptor, and alloc_len=0xFFFFFFF0 returns INSUFF_RES with no KASAN
report.

Flagging it in case the copy of this pattern in your queued patch has the same
corner.

Thanks again for the review,
Ibrahim