[PATCH] scsi: sd_zbc: cap zone report count by buffer size

[PATCH] scsi: sd_zbc: cap zone report count by buffer size

[Boyan Liu]

sd_zbc_report_zones() limits descriptor parsing to the requested zone
count and the device-reported ZONE LIST LENGTH, but not to the number of
descriptors that fit in the allocated report buffer. A malicious or
malfunctioning device can report an oversized length and cause
out-of-bounds reads while the descriptors are parsed:

    BUG: KASAN: slab-out-of-bounds in sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256)
    Read of size 8 at addr ffff88802c8d2610 by task kworker/u8:2/37
    Call Trace:
     sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256)
     blk_revalidate_disk_zones (block/blk-zoned.c:2354)
     sd_zbc_revalidate_zones (drivers/scsi/sd_zbc.c:566)
     sd_revalidate_disk (drivers/scsi/sd.c:3898)
     sd_probe (drivers/scsi/sd.c:4101)

Cap the descriptor count with min3() over the remaining requested zones,
the device-reported count, and max_in_buf derived from buflen. This
matches nvme_ns_report_zones() and preserves iteration over reports
that require multiple commands.

Fixes: d41003513e61 ("block: rework zone reporting")
Cc: stable@vger.kernel.org
Reported-by: co+4a4f9998e2b4b490@bugs.sh
Signed-off-by: Boyan Liu <yymhvert@gmail.com>
---
 drivers/scsi/sd_zbc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 56e455fb5add..6a2644a67849 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -222,7 +222,7 @@ int sd_zbc_report_zones(struct gendisk *disk, sector_t sector,
 {
 	struct scsi_disk *sdkp = scsi_disk(disk);
 	sector_t lba = sectors_to_logical(sdkp->device, sector);
-	unsigned int nr, i;
+	unsigned int nr, i, max_in_buf;
 	unsigned char *buf;
 	u64 zone_length, start_lba;
 	size_t offset, buflen = 0;
@@ -241,13 +241,16 @@ int sd_zbc_report_zones(struct gendisk *disk, sector_t sector,
 	if (!buf)
 		return -ENOMEM;
 
+	max_in_buf = (buflen - 64) / 64;
+
 	while (zone_idx < nr_zones && lba < sdkp->capacity) {
 		ret = sd_zbc_do_report_zones(sdkp, buf, buflen, lba, true);
 		if (ret)
 			goto out;
 
 		offset = 0;
-		nr = min(nr_zones, get_unaligned_be32(&buf[0]) / 64);
+		nr = min3(nr_zones - zone_idx,
+			  get_unaligned_be32(&buf[0]) / 64, max_in_buf);
 		if (!nr)
 			break;
 
-- 
2.43.0