[PATCH] scsi: scsi_debug: fix one-partition tape setup bounds

[PATCH] scsi: scsi_debug: fix one-partition tape setup bounds

[Samuel Moelius]

The tape setup path writes partition metadata one element past the
allocated tape_blocks array when a one-partition configuration is
selected.

That corrupts adjacent state during device initialization before any
command is issued.

Use the allocated partition bounds when initializing the tape block
array.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
---
 drivers/scsi/scsi_debug.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 1515495fd9ea..dda19793862d 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -3664,9 +3664,13 @@ static int partition_tape(struct sdebug_dev_info *devip, int nbr_partitions,
 	devip->tape_eop[0] = part_0_size;
 	devip->tape_blocks[0]->fl_size = TAPE_BLOCK_EOD_FLAG;
 	devip->tape_eop[1] = part_1_size;
-	devip->tape_blocks[1] = devip->tape_blocks[0] +
-			devip->tape_eop[0];
-	devip->tape_blocks[1]->fl_size = TAPE_BLOCK_EOD_FLAG;
+	if (nbr_partitions > 1 && part_1_size > 0) {
+		devip->tape_blocks[1] = devip->tape_blocks[0] +
+				devip->tape_eop[0];
+		devip->tape_blocks[1]->fl_size = TAPE_BLOCK_EOD_FLAG;
+	} else {
+		devip->tape_blocks[1] = NULL;
+	}
 
 	for (i = 0 ; i < TAPE_MAX_PARTITIONS; i++)
 		devip->tape_location[i] = 0;
-- 
2.43.0

Re: [PATCH] scsi: scsi_debug: fix one-partition tape setup bounds

[James Bottomley]

On Wed, 2026-06-03 at 18:25 +0000, Samuel Moelius wrote:
> The tape setup path writes partition metadata one element past the
> allocated tape_blocks array when a one-partition configuration is
> selected.

I don't think that's correct.  tape_blocks is defined in struct
sdebug_dev_info as

	struct tape_block *tape_blocks[TAPE_MAX_PARTITIONS];

so tape_blocks[1] is always allocated.  You can argue it shouldn't be
written to even though it is allocated, but that's not what you wrote.

Regards,

James

Re: [PATCH] scsi: scsi_debug: fix one-partition tape setup bounds

[Samuel Moelius]

On Wed, Jun 3, 2026 at 4:45 PM James Bottomley
<James.Bottomley@hansenpartnership.com> wrote:
>
> On Wed, 2026-06-03 at 18:25 +0000, Samuel Moelius wrote:
> > The tape setup path writes partition metadata one element past the
> > allocated tape_blocks array when a one-partition configuration is
> > selected.
>
> I don't think that's correct.  tape_blocks is defined in struct
> sdebug_dev_info as
>
>         struct tape_block *tape_blocks[TAPE_MAX_PARTITIONS];
>
> so tape_blocks[1] is always allocated.  You can argue it shouldn't be
> written to even though it is allocated, but that's not what you wrote.

Please disregard this patch. I will submit a new one.