diff options
| author | Jia Jia <physicalmtea@gmail.com> | 2026-10-21 17:43:34 +0800 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-10-30 21:02:22 -0400 |
| commit | 5d5913710c81eed6fa275b6a24773059d9dbfdfa (patch) | |
| tree | ddf09058cae523e8b3336024cc0cbeede6581d7c /scripts/dummy-tools/python3 | |
| parent | d58e6d962e5b59297be24d908f41af93f20ec11f (diff) | |
scsi: target: Validate REGISTER AND MOVE TransportID length
REGISTER AND MOVE has a 24-byte parameter-list header followed by a
TransportID. A 24-byte parameter list with a zero TransportID length
passes the existing tid_len + 24 check, then the handler reads buf[24] for
the TransportID protocol identifier, one byte past the received parameter
list.
A TransportID is at least 24 bytes. Reject shorter TransportIDs and
compare the declared length with the bytes following the header before
reading buf[24].
A malformed PR OUT sent through vhost-scsi triggered this read on a KASAN
kernel. The command is now rejected with INVALID PARAMETER LIST before
buf[24] is accessed.
Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
Link: https://patch.msgid.link/20261021094334.198599-1-physicalmtea@gmail.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'scripts/dummy-tools/python3')
0 files changed, 0 insertions, 0 deletions