github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
master
linux/drivers/target/iscsi
History
Carlos Bilbao 2f3835771d scsi: target: iscsi: reject invalid size Extended CDB AHS 
If ecdb_ahdr->ahslength is zero, two bugs follow:

  kmalloc(be16_to_cpu(ecdb_ahdr->ahslength) + 15, ...)

allocates 15 bytes, but the immediately following memcpy writes
ISCSI_CDB_SIZE (16) bytes into it, a one-byte heap overflow. Also:

  memcpy(cdb + ISCSI_CDB_SIZE, ecdb_ahdr->ecdb,
           be16_to_cpu(ecdb_ahdr->ahslength) - 1);

(u16)0 - 1 promotes to (int)-1 which converts to SIZE_MAX as size_t,
causing a massive out-of-bounds write.

Reject ahslength == 0 with ISCSI_REASON_PROTOCOL_ERROR before the kmalloc.
Also reject ahslength values that exceed the actual AHS buffer advertised.

Fixes: 8f1f7d297b ("scsi: target: iscsi: Add support for extended CDB AHS")
Signed-off-by: Carlos Bilbao <carlos.bilbao@kernel.org>
Reviewed-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Link: https://patch.msgid.link/20260415040728.187680-1-carlos.bilbao@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-04-21 21:08:25 -04:00
..
cxgbit Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iscsi_target_auth.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iscsi_target_auth.h scsi: target: iscsi: Rename iscsi_conn to iscsit_conn 2022-05-10 22:32:20 -04:00
iscsi_target_configfs.c scsi: target: Use driver completion preference by default 2026-02-28 21:04:02 -05:00
iscsi_target_datain_values.c scsi: target: iscsi: Rename iscsi_conn to iscsit_conn 2022-05-10 22:32:20 -04:00
iscsi_target_datain_values.h scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd 2022-05-10 22:32:20 -04:00
iscsi_target_device.c scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_device.h scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_erl1.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
iscsi_target_erl1.h scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_erl2.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iscsi_target_erl2.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_erl0.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
iscsi_target_erl0.h scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_login.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iscsi_target_login.h scsi: target: iscsi: switch to using the crc32c library 2024-12-01 17:23:02 -08:00
iscsi_target_nego.c scsi: target: iscsi: Fix typos 2025-02-12 22:01:34 -05:00
iscsi_target_nego.h scsi: target: Remove unused declarations 2024-08-22 21:15:21 -04:00
iscsi_target_nodeattrib.c scsi: target: iscsi: Control authentication per ACL 2022-06-07 21:55:11 -04:00
iscsi_target_nodeattrib.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
iscsi_target_parameters.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iscsi_target_parameters.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_seq_pdu_list.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
iscsi_target_seq_pdu_list.h scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd 2022-05-10 22:32:20 -04:00
iscsi_target_stat.c scsi: target: iscsi: Rename iscsi_session to iscsit_session 2022-05-10 22:32:21 -04:00
iscsi_target_tmr.c scsi: target: iscsi: Use int type to store negative value 2025-09-09 22:05:36 -04:00
iscsi_target_tmr.h scsi: target: iscsi: Rename iscsi_conn to iscsit_conn 2022-05-10 22:32:20 -04:00
iscsi_target_tpg.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iscsi_target_tpg.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target_transport.c scsi: target: Make iscsit_register_transport() return void 2020-08-04 20:56:56 -04:00
iscsi_target_util.c scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() 2026-01-16 23:02:15 -05:00
iscsi_target_util.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
iscsi_target.c scsi: target: iscsi: reject invalid size Extended CDB AHS 2026-04-21 21:08:25 -04:00
iscsi_target.h scsi: target: Remove unused functions 2025-01-02 13:19:34 -05:00
Kconfig scsi: target: iscsi: switch to using the crc32c library 2024-12-01 17:23:02 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00