From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Adam Nichols <adam@grimm-co.com>,
Lee Duncan <lduncan@suse.com>,
Mike Christie <michael.christie@oracle.com>,
Chris Leech <cleech@redhat.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>
Subject: [PATCH 4.14 34/39] scsi: iscsi: Verify lengths on passthrough PDUs
Date: Fri, 5 Mar 2021 13:22:33 +0100 [thread overview]
Message-ID: <20210305120853.492572090@linuxfoundation.org> (raw)
In-Reply-To: <20210305120851.751937389@linuxfoundation.org>
From: Chris Leech <cleech@redhat.com>
commit f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5 upstream.
Open-iSCSI sends passthrough PDUs over netlink, but the kernel should be
verifying that the provided PDU header and data lengths fall within the
netlink message to prevent accessing beyond that in memory.
Cc: stable@vger.kernel.org
Reported-by: Adam Nichols <adam@grimm-co.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_transport_iscsi.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -3507,6 +3507,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
{
int err = 0;
u32 portid;
+ u32 pdu_len;
struct iscsi_uevent *ev = nlmsg_data(nlh);
struct iscsi_transport *transport = NULL;
struct iscsi_internal *priv;
@@ -3624,6 +3625,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
err = -EINVAL;
break;
case ISCSI_UEVENT_SEND_PDU:
+ pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);
+
+ if ((ev->u.send_pdu.hdr_size > pdu_len) ||
+ (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {
+ err = -EINVAL;
+ break;
+ }
+
conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);
if (conn)
ev->r.retcode = transport->send_pdu(conn,
next prev parent reply other threads:[~2021-03-05 12:40 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-05 12:21 [PATCH 4.14 00/39] 4.14.224-rc1 review Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 01/39] net: usb: qmi_wwan: support ZTE P685M modem Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 02/39] scripts: use pkg-config to locate libcrypto Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 03/39] scripts: set proper OpenSSL include dir also for sign-file Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 04/39] hugetlb: fix update_and_free_page contig page struct assumption Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 05/39] drm/virtio: use kvmalloc for large allocations Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 06/39] virtio/s390: implement virtio-ccw revision 2 correctly Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 07/39] arm64 module: set plt* section addresses to 0x0 Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 08/39] arm64: Avoid redundant type conversions in xchg() and cmpxchg() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 09/39] arm64: cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 10/39] arm64: Use correct ll/sc atomic constraints Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 11/39] JFS: more checks for invalid superblock Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 12/39] media: mceusb: sanity check for prescaler value Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 13/39] xfs: Fix assert failure in xfs_setattr_size() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 14/39] smackfs: restrict bytes count in smackfs write functions Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 15/39] net: fix up truesize of cloned skb in skb_prepare_for_shift() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 16/39] mm/hugetlb.c: fix unnecessary address expansion of pmd sharing Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 17/39] net: bridge: use switchdev for port flags set through sysfs too Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 18/39] dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/ Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 19/39] staging: fwserial: Fix error handling in fwserial_create Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 20/39] x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 21/39] vt/consolemap: do font sum unsigned Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 22/39] wlcore: Fix command execute failure 19 for wl12xx Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 23/39] pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 24/39] ath10k: fix wmi mgmt tx queue full due to race condition Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 25/39] x86/build: Treat R_386_PLT32 relocation as R_386_PC32 Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 26/39] Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 27/39] staging: most: sound: add sanity check for function argument Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 28/39] media: uvcvideo: Allow entities with no pads Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 29/39] f2fs: handle unallocated section and zone on pinned/atgc Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 30/39] parisc: Bump 64-bit IRQ stack size to 64 KB Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 31/39] scsi: iscsi: Restrict sessions and handles to admin capabilities Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 32/39] sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 33/39] scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE Greg Kroah-Hartman
2021-03-05 12:22 ` Greg Kroah-Hartman [this message]
2021-03-05 12:22 ` [PATCH 4.14 35/39] Xen/gnttab: handle p2m update errors on a per-slot basis Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 36/39] xen-netback: respect gnttab_map_refs()s return value Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 37/39] zsmalloc: account the number of compacted pages correctly Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 38/39] swap: fix swapfile read/write offset Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 4.14 39/39] media: v4l: ioctl: Fix memory leak in video_usercopy Greg Kroah-Hartman
2021-03-06 10:16 ` [PATCH 4.14 00/39] 4.14.224-rc1 review Naresh Kamboju
2021-03-06 16:30 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210305120853.492572090@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=adam@grimm-co.com \
--cc=cleech@redhat.com \
--cc=lduncan@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=michael.christie@oracle.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).