This is a note to let you know that I've just added the patch titled
scsi: iscsi: Verify lengths on passthrough PDUs
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scsi-iscsi-verify-lengths-on-passthrough-pdus.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5 Mon Sep 17 00:00:00 2001
From: Chris Leech <cleech@xxxxxxxxxx>
Date: Tue, 23 Feb 2021 21:39:01 -0800
Subject: scsi: iscsi: Verify lengths on passthrough PDUs
From: Chris Leech <cleech@xxxxxxxxxx>
commit f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5 upstream.
Open-iSCSI sends passthrough PDUs over netlink, but the kernel should be
verifying that the provided PDU header and data lengths fall within the
netlink message to prevent accessing beyond that in memory.
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Adam Nichols <adam@xxxxxxxxxxxx>
Reviewed-by: Lee Duncan <lduncan@xxxxxxxx>
Reviewed-by: Mike Christie <michael.christie@xxxxxxxxxx>
Signed-off-by: Chris Leech <cleech@xxxxxxxxxx>
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/scsi/scsi_transport_iscsi.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -3526,6 +3526,7 @@ static int
iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
{
int err = 0;
+ u32 pdu_len;
struct iscsi_uevent *ev = nlmsg_data(nlh);
struct iscsi_transport *transport = NULL;
struct iscsi_internal *priv;
@@ -3641,6 +3642,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
err = -EINVAL;
break;
case ISCSI_UEVENT_SEND_PDU:
+ pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);
+
+ if ((ev->u.send_pdu.hdr_size > pdu_len) ||
+ (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {
+ err = -EINVAL;
+ break;
+ }
+
conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);
if (conn)
ev->r.retcode = transport->send_pdu(conn,
Patches currently in stable-queue which might be from cleech@xxxxxxxxxx are
queue-4.4/scsi-iscsi-restrict-sessions-and-handles-to-admin-capabilities.patch
queue-4.4/scsi-iscsi-ensure-sysfs-attributes-are-limited-to-page_size.patch
queue-4.4/scsi-iscsi-verify-lengths-on-passthrough-pdus.patch
