Re: [PATCH v2] scsi: libiscsi_tcp: bound SCSI Response data segment to the connection buffer
"'Martin K. Petersen' via open-iscsi" <open-iscsi-/[email protected]>
| Newsgroups | gmane.linux.iscsi.open-iscsi,gmane.linux.scsi,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 16 Jul 2026 15:58:48 +0900, HyeongJun An wrote:
> iscsi_tcp_hdr_dissect() receives the data segment of several PDU types
> into the fixed-size conn->data buffer, which is allocated for
> ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,
> REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU
> whose DataSegmentLength exceeds that buffer.
>
> The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its
> data segment (sense/response data) into conn->data via
> iscsi_tcp_data_recv_prep(), but it does so without the same check. The
> only upstream bound on in.datalen is conn->max_recv_dlength, the
> initiator's advertised MaxRecvDataSegmentLength, which is commonly
> negotiated well above 8192 (open-iscsi defaults to 262144). A target
> that returns a SCSI Response with a DataSegmentLength between 8193 and
> max_recv_dlength therefore overflows the 8192-byte conn->data buffer.
>
> [...]
Applied to 7.2/scsi-fixes, thanks!
[1/1] scsi: libiscsi_tcp: bound SCSI Response data segment to the connection buffer
https://git.kernel.org/mkp/scsi/c/c1dea15f819c
--
Martin K. Petersen
--
You received this message because you are subscribed to the Google Groups "open-iscsi" group.
To unsubscribe from this group and stop receiving emails from it, send an email to open-iscsi+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To view this discussion visit https://groups.google.com/d/msgid/open-iscsi/178529373834.132455.4134024360463248995.b4-ty%40oracle.com.