diff options
| author | Ratnaker Gautam <ratnaker.gautam@kuleuven.be> | 2026-10-19 21:30:33 +0000 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-10-23 22:48:05 -0400 |
| commit | eb7aa7fd673fdc1582223cd133bcc5f54e7af19f (patch) | |
| tree | 9d7263d7cdc23fd2ed1df1a83e2b8a1e5a310ca4 /scripts/dummy-tools/python3 | |
| parent | a7ac98eb6c39be4cff3ffe06ce240f7a331aa1ee (diff) | |
scsi: libiscsi_tcp: Prevent R2T range check overflow
An iSCSI target controls the R2T data offset and length as 32-bit
values. Adding them before comparing the result with the SCSI data buffer
length can wrap. An R2T with offset 1 and length U32_MAX then passes the
check for a 4096-byte write.
The transmit path treats the wrapped range as valid, exhausts the command
scatterlist, and dereferences the NULL next entry in
iscsi_tcp_segment_done().
Check the offset first, then compare the length with the remaining bytes in
the data buffer.
Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
Acked-by: Chris Leech <cleech@redhat.com>
Link: https://patch.msgid.link/DB5PR08MB100629CD3750FBF71475B5224FD982@DB5PR08MB10062.eurprd08.prod.outlook.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
Diffstat (limited to 'scripts/dummy-tools/python3')
0 files changed, 0 insertions, 0 deletions