scsi: sd_zbc: Cap zone report count by buffer size

sd_zbc_report_zones() limits descriptor parsing to the requested zone
count and the device-reported ZONE LIST LENGTH, but not to the number of
descriptors that fit in the allocated report buffer. A malicious or
malfunctioning device can report an oversized length and cause
out-of-bounds reads while the descriptors are parsed:

    BUG: KASAN: slab-out-of-bounds in sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256)
    Read of size 8 at addr ffff88802c8d2610 by task kworker/u8:2/37
    Call Trace:
     sd_zbc_report_zones (drivers/scsi/sd_zbc.c:256)
     blk_revalidate_disk_zones (block/blk-zoned.c:2354)
     sd_zbc_revalidate_zones (drivers/scsi/sd_zbc.c:566)
     sd_revalidate_disk (drivers/scsi/sd.c:3898)
     sd_probe (drivers/scsi/sd.c:4101)

Cap the descriptor count with min3() over the remaining requested zones,
the device-reported count, and max_in_buf derived from buflen. This
matches nvme_ns_report_zones() and preserves iteration over reports that
require multiple commands. Use shared constants for the REPORT ZONES
header and zone descriptor sizes.

[mkp: define constants]

Fixes: d41003513e61 ("block: rework zone reporting")
Cc: stable@vger.kernel.org
Reported-by: co+4a4f9998e2b4b490@bugs.sh
Signed-off-by: Boyan Liu <yymhvert@gmail.com>
Link: https://patch.msgid.link/20261028061651.110435-1-yymhvert@gmail.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions