kernel/linux.git/drivers/scsi, branch v5.10.268

scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

2026-08-23T12:16:27+00:00

resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) - RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD); arr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1); For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to 0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit and truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which passes the !arr check, and desc = arr + 64 is then dereferenced in the loop -> out-of-bounds write / panic. Clamp rep_max_zones to devip->nr_zones. The loop already stops at sdebug_capacity (after nr_zones zones), so a report can never hold more than nr_zones descriptors; the clamp does not change the report, it only bounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device property that can never reach 0x100000000. Fixes: 7db0e0c8190a ("scsi: scsi_debug: Fix buffer size of REPORT ZONES command") Suggested-by: Damien Le Moal Cc: stable@vger.kernel.org Signed-off-by: Ibrahim Hashimov Assisted-by: AuditCode-AI:2026.07 Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260712183739.83915-1-security@auditcode.ai Signed-off-by: Martin K. Petersen [ Adjusted for 5.10: resp_report_zones() here predates commit 4a5fc1c6d752 ("scsi: scsi_debug: Add gap zone support"), so it still computes max_zones = devip->nr_zones - (zs_lba >> devip->zsize_shift); and bounds the descriptor loop with it. Keep that existing, tighter clamp instead of introducing a second one against devip->nr_zones: max_zones is by construction <= devip->nr_zones and is the actual number of descriptors the loop can emit, so it satisfies the upstream requirement that arr_len be bounded by a real device property while leaving the reported zone list unchanged. Without the fix 5.10 has the same class of bug from the other end of the range: for alloc_len in 1..63 the unsigned (alloc_len - 64) underflows, kzalloc(alloc_len) returns a sub-64-byte buffer, and both the report header at arr + 0 and desc = arr + 64 are written out of bounds. Sizing the allocation from rep_max_zones rather than from alloc_len fixes that too. ] (cherry picked from commit 93dde0bf2f39a0f9f57fd610aa3201ce5b753433) Signed-off-by: Greg Kroah-Hartman

scsi: scsi_debug: Rename zone type constants

2026-08-23T12:16:27+00:00

[ Upstream commit 35dbe2b9a7b0c92777c855c6a2cca8390f4c166b ] Rename the scsi_debug zone type constants to prevent a conflict with the ZBC_ZONE_TYPE_GAP constant from include/scsi/scsi_proto.h. Link: https://lore.kernel.org/r/20220421183023.3462291-9-bvanassche@acm.org Cc: Douglas Gilbert Acked-by: Douglas Gilbert Signed-off-by: Damien Le Moal [ bvanassche: Extracted these changes from a larger patch ] Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Stable-dep-of: 93dde0bf2f39 ("scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics()

2026-08-23T12:16:27+00:00

[ Upstream commit 60caf3758103b8edc90724ba781ff119f739162a ] Return early in sd_zbc_check_zoned_characteristics() for host-aware disks. This patch does not change any functionality but makes a later patch easier to read. Link: https://lore.kernel.org/r/20220421183023.3462291-6-bvanassche@acm.org Reviewed-by: Himanshu Madhani Acked-by: Douglas Gilbert Signed-off-by: Damien Le Moal [ bvanassche: extracted this change from a larger patch ] Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Stable-dep-of: 93dde0bf2f39 ("scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

scsi: sd: sd_zbc: Use logical blocks as unit when querying zones

2026-08-23T12:16:27+00:00

[ Upstream commit 43af5da09efb8abe450ec859d3063adeb7d1eb54 ] When querying zones, track the position in logical blocks instead of in sectors. This change slightly simplifies sd_zbc_report_zones(). Link: https://lore.kernel.org/r/20220421183023.3462291-4-bvanassche@acm.org Reviewed-by: Himanshu Madhani Acked-by: Douglas Gilbert Signed-off-by: Damien Le Moal [ bvanassche: extracted this change from a larger patch ] Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Stable-dep-of: 93dde0bf2f39 ("scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

scsi: sd: sd_zbc: Improve source code documentation

2026-08-23T12:16:27+00:00

[ Upstream commit aa96bfb4caff59c93f0637092efe3a714cab0fe6 ] Add several kernel-doc headers. Declare input arrays const. Specify the array size in function declarations. Link: https://lore.kernel.org/r/20220421183023.3462291-2-bvanassche@acm.org Reviewed-by: Damien Le Moal Reviewed-by: Himanshu Madhani Acked-by: Douglas Gilbert Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Stable-dep-of: 93dde0bf2f39 ("scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

2026-08-23T12:16:22+00:00

[ Upstream commit 1bd28625e25be549ee7c47532e7c3ef91c682410 ] The memory allocated for mboxq using mempool_alloc() is not freed in some of the early exit error paths. Fix that by moving the mempool_free() call to an earlier point after last use. Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal Reviewed-by: Justin Tee Link: https://patch.msgid.link/20260707065304.949135-1-nihaal@cse.iitm.ac.in Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

scsi: scsi_debug: Negate wrapped memcmp() result

2026-08-19T15:12:14+00:00

commit c4f6916a99cf105c3ff340b6210fcbba3fa66b35 upstream. comp_write_worker() returns true when the compared data matches. memcmp() returns zero for equal data and non-zero for different data, so its result must be negated before it is stored in a bool. The first segment already uses !memcmp(), but the wrapped segment uses memcmp() directly, reversing the match result. Use !memcmp() there as well. Fixes: 38d5c8336e60 ("scsi_debug: add Report supported opcodes+tmfs; Compare and write") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Reviewed-by: John Garry Link: https://patch.msgid.link/E5AD42E9C0E18633+20260803095328.3445311-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen (Oracle) Signed-off-by: Greg Kroah-Hartman

scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

2026-08-19T15:12:06+00:00

[ Upstream commit c1dea15f819cded9b3faf58f8bec72323568b6e6 ] iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check. Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Suggested-by: Chris Leech Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Acked-by: Chris Leech Link: https://patch.msgid.link/20260716065848.1653431-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

2026-08-19T15:12:06+00:00

[ Upstream commit 98b87885de4b7f605533a2860685f5689fce8e82 ] iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >= senselen: senselen = get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check. Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Suggested-by: Sashiko AI Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Acked-by: Chris Leech Link: https://patch.msgid.link/20260714104934.1404423-1-sammiee5311@gmail.com Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: sg: Report request-table problems when any status is set

2026-07-24T13:49:13+00:00

commit 1d3a742afeb761eaead774691bde1ced699e9a5d upstream. SG_GET_REQUEST_TABLE reports per-request diagnostic state through sg_req_info::problem. The field is meant to indicate whether there is an error to report for a completed request. sg_fill_request_table() currently combines masked_status, host_status and driver_status with bitwise AND. This only reports a problem when all three status fields are non-zero at the same time. A normal target check condition, for example, has masked_status set while host_status and driver_status may both be zero, so the request is incorrectly reported as clean. Use the same condition as sg_new_read(), which sets SG_INFO_CHECK when any of the three status fields is non-zero. Cc: stable@vger.kernel.org Signed-off-by: Xu Rao Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/54B60C19F7DB8889+20260707030845.970018-1-raoxu@uniontech.com Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman