Re: [PATCH] scsi: libiscsi: fix stale-data leak into the SCSI sense buffer
"'Martin K. Petersen' via open-iscsi" <open-iscsi-/[email protected]>
| Newsgroups | gmane.linux.iscsi.open-iscsi,gmane.linux.scsi,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 14 Jul 2026 19:49:34 +0900, HyeongJun An wrote:
> iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the
> target-supplied data segment. The segment carries a 2-byte sense length
> followed by the sense bytes, so it must hold 2 + senselen bytes, but the
> bounds check only requires datalen >= senselen:
>
> senselen = get_unaligned_be16(data);
> if (datalen < senselen)
> goto invalid_datalen;
> memcpy(sc->sense_buffer, data + 2,
> min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
>
> [...]
Applied to 7.2/scsi-fixes, thanks!
[1/1] scsi: libiscsi: fix stale-data leak into the SCSI sense buffer
https://git.kernel.org/mkp/scsi/c/98b87885de4b
--
Martin K. Petersen
--
You received this message because you are subscribed to the Google Groups "open-iscsi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to open-iscsi+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To view this discussion visit https://groups.google.com/d/msgid/open-iscsi/178529373833.132455.5035490797590781026.b4-ty%40oracle.com.