Re: [PATCH v3] scsi: target: iscsi: reject invalid size Extended CDB AHS

"Martin K. Petersen" <[email protected]> Tue, 21 Apr 2026 21:11:33 -0400

Newsgroups	org.kernel.vger.target-devel,org.kernel.vger.linux-kernel,org.kernel.vger.linux-scsi
Organization	Oracle Corporation
Message-ID	<[email protected]>

Carlos,

> If ecdb_ahdr->ahslength is zero, two bugs follow:
>
>   kmalloc(be16_to_cpu(ecdb_ahdr->ahslength) + 15, ...)
>
> allocates 15 bytes, but the immediately following memcpy writes
> ISCSI_CDB_SIZE (16) bytes into it, a one-byte heap overflow. Also:

Applied to 7.1/scsi-staging, thanks!

-- 
Martin K. Petersen