Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 56c108c6 authored by Chris Leech's avatar Chris Leech Committed by Greg Kroah-Hartman
Browse files

scsi: iscsi: Verify lengths on passthrough PDUs 



commit f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5 upstream.

Open-iSCSI sends passthrough PDUs over netlink, but the kernel should be
verifying that the provided PDU header and data lengths fall within the
netlink message to prevent accessing beyond that in memory.

Cc: stable@vger.kernel.org
Reported-by: default avatarAdam Nichols <adam@grimm-co.com>
Reviewed-by: default avatarLee Duncan <lduncan@suse.com>
Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Signed-off-by: default avatarChris Leech <cleech@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b8a757b5

drivers/scsi/scsi_transport_iscsi.c

+9 −0
Original line number Original line Diff line number Diff line
@@ -3526,6 +3526,7 @@ static int 
iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)

iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)

{

{

	int err = 0;

	int err = 0;

	u32 pdu_len;

	struct iscsi_uevent *ev = nlmsg_data(nlh);

	struct iscsi_uevent *ev = nlmsg_data(nlh);

	struct iscsi_transport *transport = NULL;

	struct iscsi_transport *transport = NULL;

	struct iscsi_internal *priv;

	struct iscsi_internal *priv;
@@ -3641,6 +3642,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) 
			err = -EINVAL;

			err = -EINVAL;

		break;

		break;

	case ISCSI_UEVENT_SEND_PDU:

	case ISCSI_UEVENT_SEND_PDU:

		pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);



		if ((ev->u.send_pdu.hdr_size > pdu_len) ||

		    (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {

			err = -EINVAL;

			break;

		}



		conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);

		conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);

		if (conn)

		if (conn)

			ev->r.retcode =	transport->send_pdu(conn,

			ev->r.retcode =	transport->send_pdu(conn,