Re: [PATCH] scsi: libiscsi: fix stale-data leak into the SCSI sense buffer

On Tue, 14 Jul 2026 19:49:34 +0900, HyeongJun An wrote:

> iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the
> target-supplied data segment.  The segment carries a 2-byte sense length
> followed by the sense bytes, so it must hold 2 + senselen bytes, but the
> bounds check only requires datalen >= senselen:
> 
> 	senselen = get_unaligned_be16(data);
> 	if (datalen < senselen)
> 		goto invalid_datalen;
> 	memcpy(sc->sense_buffer, data + 2,
> 	       min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
> 
> [...]

Applied to 7.2/scsi-fixes, thanks!

[1/1] scsi: libiscsi: fix stale-data leak into the SCSI sense buffer
      https://git.kernel.org/mkp/scsi/c/98b87885de4b

-- 
Martin K. Petersen