The previous commit discussed at link https://lore.kernel.org/all/20230723075938.3713864-1-linma@xxxxxxxxxx/ adds length checks for the manual parsing loop in function beiscsi_iface_set_param(..) hence ensures the attribute being parsed has a valid length. However, the child function of beiscsi_iface_set_param, beiscsi_iface_config_ipv4 calls nla_find to locate and parse attributes ISCSI_NET_PARAM_IPV4_ADDR and ISCSI_NET_PARAM_IPV4_SUBNET. That is, if these two attributes are placed after the ISCSI_NET_PARAM command, they can bypass the added check and still cause an out-of-attribute access. Add extra nla_len checks after those two call sites to nla_find to keep malformed attributes away. Fixes: 0e43895ec1f4 ("[SCSI] be2iscsi: adding functionality to change network settings using iscsiadm") Signed-off-by: Lin Ma <linma@xxxxxxxxxx> --- v1 -> v2: resent because the mail failed to reach public list drivers/scsi/be2iscsi/be_iscsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c index 8aeaddc93b16..acd3e587455b 100644 --- a/drivers/scsi/be2iscsi/be_iscsi.c +++ b/drivers/scsi/be2iscsi/be_iscsi.c @@ -374,7 +374,7 @@ beiscsi_iface_config_ipv4(struct Scsi_Host *shost, case ISCSI_NET_PARAM_IPV4_ADDR: ip = info->value; nla = nla_find(data, dt_len, ISCSI_NET_PARAM_IPV4_SUBNET); - if (nla) { + if (nla && nla_len(nla) >= sizeof(*info)) { info = nla_data(nla); subnet = info->value; } @@ -388,7 +388,7 @@ beiscsi_iface_config_ipv4(struct Scsi_Host *shost, */ subnet = info->value; nla = nla_find(data, dt_len, ISCSI_NET_PARAM_IPV4_ADDR); - if (nla) { + if (nla && nla_len(nla) >= sizeof(*info)) { info = nla_data(nla); ip = info->value; } -- 2.17.1
