mirror of
https://github.com/torvalds/linux.git
synced 2026-09-23 13:14:02 +02:00
f4825922d2
iscsi_target_check_login_request() rejects a login PDU whose
DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and
login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS
bytes. Since iscsit_get_login_rx() receives payload_length + padding
bytes, where
padding = ((-payload_length) & 3);
any payload_length from 8189 to 8192 fills the whole 8192 byte
buffer. The write stays in bounds, but no byte is left for a NUL
terminator.
The buffer is subsequently consumed as a C string. In the CHAP path
chap_check_algorithm() calls kstrdup(a_str), and extract_param() calls
strstr(in_buf, pattern) followed by strlen_semi(), none of which take a
length. convert_null_to_semi() additionally rewrites every embedded NUL
to ';', so even a payload made of well formed NUL separated key=value
records is left without a terminator. These walk past the end of the
object into adjacent slab memory. It is reachable by an unauthenticated
initiator against a portal configured for CHAP; when authentication is
not required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and
the CHAP path is never entered.
Allocate one extra byte. kzalloc() zeroes it and nothing ever writes to
it, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS
bytes, so the buffer is always terminated.
Fixes:
|
||
|---|---|---|
| .. | ||
| cxgbit | ||
| iscsi_target_auth.c | ||
| iscsi_target_auth.h | ||
| iscsi_target_configfs.c | ||
| iscsi_target_datain_values.c | ||
| iscsi_target_datain_values.h | ||
| iscsi_target_device.c | ||
| iscsi_target_device.h | ||
| iscsi_target_erl1.c | ||
| iscsi_target_erl1.h | ||
| iscsi_target_erl2.c | ||
| iscsi_target_erl2.h | ||
| iscsi_target_erl0.c | ||
| iscsi_target_erl0.h | ||
| iscsi_target_login.c | ||
| iscsi_target_login.h | ||
| iscsi_target_nego.c | ||
| iscsi_target_nego.h | ||
| iscsi_target_nodeattrib.c | ||
| iscsi_target_nodeattrib.h | ||
| iscsi_target_parameters.c | ||
| iscsi_target_parameters.h | ||
| iscsi_target_seq_pdu_list.c | ||
| iscsi_target_seq_pdu_list.h | ||
| iscsi_target_stat.c | ||
| iscsi_target_tmr.c | ||
| iscsi_target_tmr.h | ||
| iscsi_target_tpg.c | ||
| iscsi_target_tpg.h | ||
| iscsi_target_transport.c | ||
| iscsi_target_util.c | ||
| iscsi_target_util.h | ||
| iscsi_target.c | ||
| iscsi_target.h | ||
| Kconfig | ||
| Makefile | ||