scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets

resp_write_scat() computes the length of an LBA range in bytes as a 32-bit
product, num_by = num * lb_size, and adds it to sg_off, the 32-bit offset
of the next range in the data-out buffer. The product wraps for a range of
4 GiB or more, which check_device_access_params() allows once the store is
that large, and sg_off wraps once the ranges add up to 4 GiB, which neither
their number nor their overlap prevents.  The ranges that follow are then
written from the wrong offset in the buffer.

Make num_by and sg_off 64-bit, and pass do_device_access() sg_off capped at
the length of the buffer. An offset at the end of the buffer copies
nothing, and sg_copy_buffer(), which takes it as an off_t, is never given
one larger than the buffer that it copies.

Assisted-by: LLM
Fixes: 481b5e5c7949 ("scsi: scsi_debug: add resp_write_scat function")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://patch.msgid.link/20260929082456.857423-21-cassel@kernel.org
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>

0 files changed, 0 insertions, 0 deletions