From nobody Sun Jul 26 01:57:25 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F6C3377ECA for ; Fri, 10 Jul 2026 05:06:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783660017; cv=none; b=AkaBBFAziDEPYLfRJFVMw8tzrp6GcmixIbiy9e72WrKuiOSIhmras7/r2/RDqhgIN6jEl40CddNkX/SQEZxkKdtce5xbJF8+gR8r0bEaX8PMhmFwo+qLgXAG/0ERmxoKpbUgheEDCTXFAlEFeD73km9lDhmgO0GZLIAYXs1PaEU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783660017; c=relaxed/simple; bh=CBxJGxNLXTZa+4GkCgJgl7hIUuvDLwrTMXiLlOdjvAs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=b3wbl1JeO7eTkyvrepLDY0pn7r2xvg2/ppMuwphG48uM0Dw2ttlf88S9O78HfOjVxtd9lSJTQMu5eh4rq/BEnfT6CpscCWXUcgQQ/K2Bd1bLc2QigF/gqYQfB1mEEYgEcCswNasQE1+b2DiHHgpe5gv5Yn4awMeV+0uhRYPX8Qc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=DSF7xmFe; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="DSF7xmFe" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2cacd69a9c0so4543145ad.1 for ; Thu, 09 Jul 2026 22:06:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783660015; x=1784264815; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=pWNfAMp36IVbKDCLkOUVS83/PLFc14nRvYbSDKyBhWs=; b=DSF7xmFeZ5CcUAKKkxU/UUwQgeytF1puvc+y66yAGfImBexwrFVsV82O3dZqCDmPp0 SPm+UP/KlmRqHKeQRVvcVN5sjYX/sI49a5p9eQhZA3c68NmncnA0rsQwwmtYFsKj2hIg 3LWrjyCA/tMZU/p9jycIjrjYMi63D+15r3T44V01bHSQ//yHlJ+bBb9Tu7Kx1HTXtL59 2HMFFplBIboY9gMRaOFzp8+8sDkxKxpK7lkLg1Owh8EVHEvztI7ek8GP9mQlRQsHHf/q l+HtnjDgs84KNMhwdTPpUgVW7If3DoOfVDCCXn5JQvSaJ2YvRlfr4UsjjEU/ve/YhJuu YOxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783660015; x=1784264815; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pWNfAMp36IVbKDCLkOUVS83/PLFc14nRvYbSDKyBhWs=; b=iOoe/lX6J6l7ID4vtgxFrR4zg2bAEOGR/Ky0KjLLhC2FG+XDUrE9wGmniJr34aatqg HCBX5m/LK76/uHozISdnB18BN4fR6KHPb/BtaQnCpCS6FwVqPALa/C/3hO/k2DnHySnf ie4V45kBdS0ywGHoZeGpfbscCm5k8oq8r4u7fMVdE/KIEkFXAB07gQJS5fA879tosjNn qdJxjbK9sWzxB0zmweVAujZ8rVk+t1kKEPyzNXXHET+DmLNmjh0h99xxD3tcdCQJl/gz xjqydsvYXx5GVnMjswqkcS//9Lt/OQdk5+QQM66DuGHB4cHLEHipvFMC+KS9LhOiWwf5 nvKw== X-Forwarded-Encrypted: i=1; AHgh+Rr0a4xi8QjthQGnWTN5NSGyDRhanhmMH5hAvLrKheusGAYeHYCCiPYXP4nLAdlpO2BWs/c75Xy5mlWlru8=@vger.kernel.org X-Gm-Message-State: AOJu0Ywe0yFTSeCxJvNzECySalvc+V+f+KR544HcRWTu1XFGxnBQDgcX RjDiYtnwW4p6fhwyNo5YNjYHLpRnc65xwBgsSfF1wAex50n2oRKtfzNs X-Gm-Gg: AfdE7cnSJNqkwMX4x/SDZCjyU9dmNmyNO3xMROG0no69lU/Lv7E+ipz2MQu/9Di/79K xOtzSKhTmv61H/ap/DuyE5yuX92qV1jCcMGEuvY1jiQ0P5Ahk6kw9xQwB3eHzWSlREoIXTU+SZR O7Dgrfi8DC5M/aqez1qtXpy5sG2VXHsGWJ2MHF/Pvglg4+j7PfAxME2la6PqBgwWDpeNWJrHJtI EyVLllveCmKJcM04rqIHLH2T2lLWwWApwJb4Sehdm2t4G9glx9S7OI6pkCJr3zPORIuZ2z/lhV3 WCEnQ618G3XtjxgJ9lja62q+rMQ2pgwoie+tsHbQEKEHW6K47Ptd7cU1O+/Y4PfZCStoHsAxboN Xix4PGjltCRUmh54XwoMabpQBuL51xpZ4Bz8a51rp37iv+1rO71CLTXyc8rZ9cpM16DuozF2mch XAej3rbQdGSQ0pNoVIsySZZXttbIoiX0GkVYfjLFY3K3F0R1G4v158XlB3Zn0RoHT6XhQjBvjFV TasAuLCMiClQl+z X-Received: by 2002:a17:903:110f:b0:2c9:bd64:8c8b with SMTP id d9443c01a7336-2ccea40dd61mr109250695ad.31.1783660015427; Thu, 09 Jul 2026 22:06:55 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9d3c99fsm53688015ad.68.2026.07.09.22.06.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Jul 2026 22:06:54 -0700 (PDT) From: HyeongJun An To: Mike Christie , Lee Duncan , Chris Leech , "Martin K . Petersen" Cc: "James E . J . Bottomley" , open-iscsi@googlegroups.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, HyeongJun An Subject: [PATCH] scsi: libiscsi_tcp: bound SCSI Response data segment to the connection buffer Date: Fri, 10 Jul 2026 14:06:45 +0900 Message-ID: <20260710050645.1194212-1-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Apply the same bound used by the sibling opcodes before handing the data segment to conn->data. Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An --- drivers/scsi/libiscsi_tcp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c index e90805ba868f..790d11ec00bc 100644 --- a/drivers/scsi/libiscsi_tcp.c +++ b/drivers/scsi/libiscsi_tcp.c @@ -753,6 +753,18 @@ iscsi_tcp_hdr_dissect(struct iscsi_conn *conn, struct = iscsi_hdr *hdr) spin_unlock(&conn->session->back_lock); break; case ISCSI_OP_SCSI_CMD_RSP: + /* + * Sense/response data is received into conn->data, so bound + * it to that buffer like the responses handled below. + */ + if (tcp_conn->in.datalen > ISCSI_DEF_MAX_RECV_SEG_LEN) { + iscsi_conn_printk(KERN_ERR, conn, + "iscsi_tcp: received buffer of len %u but conn buffer is only %u (o= pcode %0x)\n", + tcp_conn->in.datalen, + ISCSI_DEF_MAX_RECV_SEG_LEN, opcode); + rc =3D ISCSI_ERR_PROTO; + break; + } if (tcp_conn->in.datalen) { iscsi_tcp_data_recv_prep(tcp_conn); return 0; --=20 2.43.0