From nobody Sat Jul 25 19:29:03 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70F662F49F6 for ; Tue, 14 Jul 2026 10:49:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784026190; cv=none; b=ThznwKuPoLjo3oAhAtGilHis3dsJ1mSa+h1BSHOubkRmy3acGA25I11R6JaoRniYoAE8KZOhmHsb0FIyGmQ2/xuMKgWFy8BbOnQpLEg7RGPybpoCwD9zq6JUdKlN2j7hLdjW/Z+CHTfJhJuZAJqd52WFXgOz2YdE8CRpMQ5DppE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784026190; c=relaxed/simple; bh=LojW2wY3VHLqJgFF1GSjT5lGd+0QwrjgK5ZbhA0zEw4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TmNgGsfub2qKQd2Q9I6UyR6NjFpNmks71ihgNkmfCzooyJgV0VuHJTu/rkNds9B4KsjWIRdAn5crqrv7qSIqUj7ZEDn9mZ/dlzIUNiN+zCnuA8xSv443q9jelxMGcG6IYcfgM3CHxF10R2M8UllGGq/sOsyDDshINi14dLPzlTM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ENX08vIt; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ENX08vIt" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2ce98cb8165so8260225ad.1 for ; Tue, 14 Jul 2026 03:49:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784026189; x=1784630989; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=KkV4GjFgROz6Q/rW4BolM9fldQ0ZJ/AlEUz7p40vHb8=; b=ENX08vIts2Pxk0Ad52Bw6r6X/FXWAwMeaI9Jaw/urotfXqX9je0Bn81bl7z6JD+uTp x+Tou6WgmWYygPlG3Yi4b0XRR1sQVkkJoG7QDkbGN3zMQPBaEBOSOD/vZkQknber2CiS H5pX1MPgvdmiBOKIyzgM/w5zfHhLlt1IMBtka87tbiHpZq2MiIg73aUbuz4D6eI9QDAj zcT/AkMrooGOP7FkRPnGEDWtjiQEd5UhXu1IdXJjXRa2bul823OqrBPh+YQLBBRjO0FF dWiym/RlvMkZHbgRvQLYd7GBtSDWSxZXM/zr+jGZnbtjVQWgrYUJIY6BY1BhhYk7Hv/U g0IQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784026189; x=1784630989; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KkV4GjFgROz6Q/rW4BolM9fldQ0ZJ/AlEUz7p40vHb8=; b=b+06w8jg7IzptHgGxez04iN5X6BWkrUH0XhJzVSL4xQ0kwBE/nRiSCuX9Q4osGIhQP gArxvBzlqKPnYnJz0+yyPNMv6H+1kiwR3tbhApFaOXbxXnCsMoIwvpwdcYxZX6NeiL3o Oz5J+lkpSWcmHTVQyF0T9xl13iI6d6DMxZszcMSV0O2R/ou0jebGbA42fyqq7mECEh6O EL/EbbBhzpyu5KcHy+RY1O7qCtti+FBkEbHqC6bBRAdZXll5yE3Kog5KqbF8e1J0byBc ScFmGjo4jRgNbe/uFtKzLfiYsPHoyL1PL5iAOOPSX/eR1fPvr7CmNWMPPIxTKtSsZqTj Wy+g== X-Forwarded-Encrypted: i=1; AHgh+Rp4QOAbI1MgXxTJW2Da/btZa1jWpJutCY3Q7Kaf+lulIqMQLw+wMgSNIQvHnEyNpOKNXlEai9xlOKAk0ng=@vger.kernel.org X-Gm-Message-State: AOJu0YwULdhplZMporbumSEonfdYPznNLN83cOVRCTap6LgBqGwJsH26 6c/Ck3bvH/L6qu2b04QlvH6etbsFftfN2erm6nrWxPGRnlCqRSJwecSJrkRVu/J4 X-Gm-Gg: AfdE7ckpEAQLaLoL6czaLmRU9U1+ng77vXd03aRQHt9IP2tLC27/tLvE5GmgEzEEST7 C7vYSYzBh/bOaXZIMdaCpselE7+68/w3ErMxgYjstXBFCjYnSGKkx45/Bo8ELWdDmKs4PpPSbSz sv49jkFUhFAlYomPuSYnfAbsceqcTA6c0/nt1oM4y2nc92qoHjA0nG7/VcqsOtJPcr+48602AM3 xnBvHo6HYoR1ktPwhVej6sOgi4gj8yBDcc0rLvb6ObBUmjelnHsAcjguoFhpGtWZ50bQ1Ax7EIp x1XvD8Dg9iqx+I3cse0sfz4TE9gS3n4xIIgM7K7Wqe60ynz8aExY9fhbjWoF4Zubp9XzHixR1XT y3x3Eo/Yup4EB8J+hTaLQL6skmSvvhobXwZum5gu4T6zc2NMRlxvG7m45+bmFGfHBRkqF3+d5Bn 14Zl9L+Dyqr4HFVIK/K96EiMtqFvpNZQU7O++70e8XEUAT7ie2X4B6r/wL5W/U9oL5uDt8JXGsH Z01Juoh6y4IPm07 X-Received: by 2002:a17:903:298e:b0:2c9:97a7:3283 with SMTP id d9443c01a7336-2cea187c0d0mr121585965ad.23.1784026188650; Tue, 14 Jul 2026 03:49:48 -0700 (PDT) Received: from nugod-NUC15CRHU5.tail9f095a.ts.net ([218.237.104.87]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cebec91c92sm38433615ad.56.2026.07.14.03.49.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 03:49:48 -0700 (PDT) From: HyeongJun An To: Mike Christie , Lee Duncan , Chris Leech , "Martin K . Petersen" Cc: "James E . J . Bottomley" , open-iscsi@googlegroups.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, HyeongJun An , Sashiko AI Subject: [PATCH] scsi: libiscsi: fix stale-data leak into the SCSI sense buffer Date: Tue, 14 Jul 2026 19:49:34 +0900 Message-ID: <20260714104934.1404423-1-sammiee5311@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hold 2 + senselen bytes, but the bounds check only requires datalen >=3D senselen: senselen =3D get_unaligned_be16(data); if (datalen < senselen) goto invalid_datalen; memcpy(sc->sense_buffer, data + 2, min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE)); A target that returns a SCSI Response whose datalen equals senselen (with senselen <=3D SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data + 2 read up to two bytes past the received data. Those bytes are stale conn->data contents and end up in the command's sense buffer, which is returned to userspace. Account for the 2-byte sense length prefix in the check. Fixes: 7996a778ff8c ("[SCSI] iscsi: add libiscsi") Suggested-by: Sashiko AI Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Acked-by: Chris Leech --- drivers/scsi/libiscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 160f02f2f51d..5cbc51899de0 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -918,7 +918,7 @@ static void iscsi_scsi_cmd_rsp(struct iscsi_conn *conn,= struct iscsi_hdr *hdr, } =20 senselen =3D get_unaligned_be16(data); - if (datalen < senselen) + if (datalen < senselen + 2) goto invalid_datalen; =20 memcpy(sc->sense_buffer, data + 2, --=20 2.43.0