Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 114b44dd authored by Konstantin Shelekhin's avatar Konstantin Shelekhin Committed by Greg Kroah-Hartman
Browse files

scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() 



[ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ]

The function lio_target_nacl_info_show() uses sprintf() in a loop to print
details for every iSCSI connection in a session without checking for the
buffer length. With enough iSCSI connections it's possible to overflow the
buffer provided by configfs and corrupt the memory.

This patch replaces sprintf() with sysfs_emit_at() that checks for buffer
boundries.

Signed-off-by: default avatarKonstantin Shelekhin <k.shelekhin@yadro.com>
Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com


Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 2ce38bd3

drivers/target/iscsi/iscsi_target_configfs.c

+27 −27
Original line number Diff line number Diff line
@@ -516,102 +516,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page) 
	spin_lock_bh(&se_nacl->nacl_sess_lock);

	se_sess = se_nacl->nacl_sess;

	if (!se_sess) {

		rb += sprintf(page+rb, "No active iSCSI Session for Initiator"

		rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator"

			" Endpoint: %s\n", se_nacl->initiatorname);

	} else {

		sess = se_sess->fabric_sess_ptr;



		rb += sprintf(page+rb, "InitiatorName: %s\n",

		rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n",

			sess->sess_ops->InitiatorName);

		rb += sprintf(page+rb, "InitiatorAlias: %s\n",

		rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n",

			sess->sess_ops->InitiatorAlias);



		rb += sprintf(page+rb,

		rb += sysfs_emit_at(page, rb,

			      "LIO Session ID: %u   ISID: 0x%6ph  TSIH: %hu  ",

			      sess->sid, sess->isid, sess->tsih);

		rb += sprintf(page+rb, "SessionType: %s\n",

		rb += sysfs_emit_at(page, rb, "SessionType: %s\n",

				(sess->sess_ops->SessionType) ?

				"Discovery" : "Normal");

		rb += sprintf(page+rb, "Session State: ");

		rb += sysfs_emit_at(page, rb, "Session State: ");

		switch (sess->session_state) {

		case TARG_SESS_STATE_FREE:

			rb += sprintf(page+rb, "TARG_SESS_FREE\n");

			rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n");

			break;

		case TARG_SESS_STATE_ACTIVE:

			rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n");

			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n");

			break;

		case TARG_SESS_STATE_LOGGED_IN:

			rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n");

			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n");

			break;

		case TARG_SESS_STATE_FAILED:

			rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n");

			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n");

			break;

		case TARG_SESS_STATE_IN_CONTINUE:

			rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n");

			rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n");

			break;

		default:

			rb += sprintf(page+rb, "ERROR: Unknown Session"

			rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session"

					" State!\n");

			break;

		}



		rb += sprintf(page+rb, "---------------------[iSCSI Session"

		rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session"

				" Values]-----------------------\n");

		rb += sprintf(page+rb, "  CmdSN/WR  :  CmdSN/WC  :  ExpCmdSN"

		rb += sysfs_emit_at(page, rb, "  CmdSN/WR  :  CmdSN/WC  :  ExpCmdSN"

				"  :  MaxCmdSN  :     ITT    :     TTT\n");

		max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn);

		rb += sprintf(page+rb, " 0x%08x   0x%08x   0x%08x   0x%08x"

		rb += sysfs_emit_at(page, rb, " 0x%08x   0x%08x   0x%08x   0x%08x"

				"   0x%08x   0x%08x\n",

			sess->cmdsn_window,

			(max_cmd_sn - sess->exp_cmd_sn) + 1,

			sess->exp_cmd_sn, max_cmd_sn,

			sess->init_task_tag, sess->targ_xfer_tag);

		rb += sprintf(page+rb, "----------------------[iSCSI"

		rb += sysfs_emit_at(page, rb, "----------------------[iSCSI"

				" Connections]-------------------------\n");



		spin_lock(&sess->conn_lock);

		list_for_each_entry(conn, &sess->sess_conn_list, conn_list) {

			rb += sprintf(page+rb, "CID: %hu  Connection"

			rb += sysfs_emit_at(page, rb, "CID: %hu  Connection"

					" State: ", conn->cid);

			switch (conn->conn_state) {

			case TARG_CONN_STATE_FREE:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"TARG_CONN_STATE_FREE\n");

				break;

			case TARG_CONN_STATE_XPT_UP:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"TARG_CONN_STATE_XPT_UP\n");

				break;

			case TARG_CONN_STATE_IN_LOGIN:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"TARG_CONN_STATE_IN_LOGIN\n");

				break;

			case TARG_CONN_STATE_LOGGED_IN:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"TARG_CONN_STATE_LOGGED_IN\n");

				break;

			case TARG_CONN_STATE_IN_LOGOUT:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"TARG_CONN_STATE_IN_LOGOUT\n");

				break;

			case TARG_CONN_STATE_LOGOUT_REQUESTED:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"TARG_CONN_STATE_LOGOUT_REQUESTED\n");

				break;

			case TARG_CONN_STATE_CLEANUP_WAIT:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"TARG_CONN_STATE_CLEANUP_WAIT\n");

				break;

			default:

				rb += sprintf(page+rb,

				rb += sysfs_emit_at(page, rb,

					"ERROR: Unknown Connection State!\n");

				break;

			}



			rb += sprintf(page+rb, "   Address %pISc %s", &conn->login_sockaddr,

			rb += sysfs_emit_at(page, rb, "   Address %pISc %s", &conn->login_sockaddr,

				(conn->network_transport == ISCSI_TCP) ?

				"TCP" : "SCTP");

			rb += sprintf(page+rb, "  StatSN: 0x%08x\n",

			rb += sysfs_emit_at(page, rb, "  StatSN: 0x%08x\n",

				conn->stat_sn);

		}

		spin_unlock(&sess->conn_lock);