sd_zbc_read_zones() computes the number of zones with 64-bit
arithmetic and stores the result in the unsigned int nr_zones field
of struct zoned_disk_info, silently truncating counts that exceed 32
bits. The truncated count is later used to size per-zone resources,
while the device may still report more zones than fit.

Reject such devices at scan time: more than 4 billion zones is not
realistic for any medium that exists today, and accepting the
truncated count produces inconsistent zone bookkeeping.

Signed-off-by: ZHOU Jiaxiang <26066541r@connect.polyu.hk>
---
 drivers/scsi/sd_zbc.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 56e455fb5addd..446628cb3db02 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -589,6 +589,7 @@ int sd_zbc_revalidate_zones(struct scsi_disk *sdkp)
 int sd_zbc_read_zones(struct scsi_disk *sdkp, struct queue_limits *lim,
                u8 buf[SD_BUF_SIZE])
 {
+       unsigned long long nr_zones64;
        unsigned int nr_zones;
        u32 zone_blocks = 0;
        int ret;
@@ -620,7 +621,15 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, struct queue_limits *lim,
        if (ret != 0)
                goto err;

-       nr_zones = round_up(sdkp->capacity, zone_blocks) >> ilog2(zone_blocks);
+       nr_zones64 = round_up(sdkp->capacity, zone_blocks) >>
+                    ilog2(zone_blocks);
+       if (nr_zones64 > UINT_MAX) {
+               sd_printk(KERN_ERR, sdkp, "Too many zones (%llu)\n",
+                         nr_zones64);
+               ret = -EINVAL;
+               goto err;
+       }
+       nr_zones = nr_zones64;
        sdkp->early_zone_info.nr_zones = nr_zones;
        sdkp->early_zone_info.zone_blocks = zone_blocks;

--
2.34.1

[https://www.polyu.edu.hk/emaildisclaimer/PolyU_Email_Signature-v2.jpg]

Disclaimer:

This message (including any attachments) contains confidential information intended for a specific individual and purpose. If you are not the intended recipient, you should delete this message and notify the sender and The Hong Kong Polytechnic University (the University) immediately. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited and may be unlawful.

The University specifically denies any responsibility for the accuracy or quality of information obtained through University E-mail Facilities. Any views and opinions expressed are only those of the author(s) and do not necessarily represent those of the University and the University accepts no liability whatsoever for any losses or damages incurred or caused to any party as a result of the use of such information.