Commit f9dbdf97 authored by Chris Leech's avatar Chris Leech Committed by Martin K. Petersen
Browse files

scsi: iscsi: Verify lengths on passthrough PDUs 



Open-iSCSI sends passthrough PDUs over netlink, but the kernel should be
verifying that the provided PDU header and data lengths fall within the
netlink message to prevent accessing beyond that in memory.

Cc: stable@vger.kernel.org
Reported-by: default avatarAdam Nichols <adam@grimm-co.com>
Reviewed-by: default avatarLee Duncan <lduncan@suse.com>
Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Signed-off-by: default avatarChris Leech <cleech@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent ec98ea70

drivers/scsi/scsi_transport_iscsi.c

+9 −0
Original line number Diff line number Diff line
@@ -3624,6 +3624,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) 
{

	int err = 0;

	u32 portid;

	u32 pdu_len;

	struct iscsi_uevent *ev = nlmsg_data(nlh);

	struct iscsi_transport *transport = NULL;

	struct iscsi_internal *priv;
@@ -3766,6 +3767,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) 
			err = -EINVAL;

		break;

	case ISCSI_UEVENT_SEND_PDU:

		pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);



		if ((ev->u.send_pdu.hdr_size > pdu_len) ||

		    (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {

			err = -EINVAL;

			break;

		}



		conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);

		if (conn) {

			mutex_lock(&conn_mutex);