Nilesh JavaliandGleb Chesnokov
5c028d876b
In qla2x00_status_entry(), the FWI2 status path advances sense_data and
shrinks par_sense_len by rsp_info_len:
if (IS_FWI2_CAPABLE(ha)) {
sense_data += rsp_info_len;
par_sense_len -= rsp_info_len;
}
rsp_info_len is a 32-bit value taken directly from the target's FCP
response (sf.rsp_data_len), while par_sense_len is the IOCB data area
size (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target
reporting an rsp_info_len larger than par_sense_len makes the unsigned
subtraction underflow to a huge value and advances sense_data out of
bounds.
The underflowed par_sense_len then defeats the cap in
qla2x00_handle_sense():
if (sense_len > par_sense_len)
sense_len = par_sense_len;
memcpy(cp->sense_buffer, sense_data, sense_len);
so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the
out-of-bounds sense_data pointer, leaking adjacent response-ring/heap
memory into the command's sense buffer.
Clamp rsp_info_len to par_sense_len before the subtraction so
par_sense_len can never underflow and sense_data stays within the IOCB
data area. The fix sits before the comp_status switch, covering both
qla2x00_handle_sense() call sites.
Fixes: 5544213be7b4 ("[SCSI] qla2xxx: Correct extended sense-data handling.")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-dev@google.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://patch.msgid.link/20260730155838.2119230-16-njavali@marvell.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
[ commit ca6d880d6c70cb7946e7b3e05d7285f271b6d99e upstream ]
Overview
This is the source code repository of the SCST project. SCST is a collection of Linux kernel drivers that implement SCSI target functionality. The SCST project includes:
- The SCST core in the scst/ subdirectory.
- A tool for loading, saving and modifying the SCST configuration in directory scstadmin/.
- Several SCSI target drivers in the directories iscsi-scst/, qla2x00t-32gbit/, qla2x00t/, srpt/, scst_local/ and fcst/.
- User space programs in the usr/ subdirectory, e.g. fileio_tgt.
- Various documentation in the doc/ subdirectory.
Documentation
- Building and installing SCST.
- Build options: Clang, cross-compilation, and kernel module signing.
- Configuration and administration: targets, devices,
LUNs, and
/etc/scst.conf. - Core and device handlers: operating modes, module parameters, and sysfs configuration.
- Target drivers: iSCSI, iSER, QLogic Fibre Channel, SRP, FCoE, and local loopback.
- Performance tuning.
- Clustered persistent reservations: synchronization through DLM.
- T10 protection information: data integrity modes and configuration.
- Developer references: architecture and userspace handler interface (SGML sources), and sysfs interface rules.
- Contributing: code style, commit conventions, local checks, and guides to KUnit and component testing.
Current master packages
Prebuilt x86_64 packages from the latest successfully published master
build are available in the rolling
master-rpm prerelease.
These are development snapshots, not SCST releases.
The snapshot contains RPM bundles for selected Rocky Linux and Oracle Linux
UEK kernels. It also contains Ubuntu LTS bundles with scst-dkms, scstadmin
and iscsi-scst binary packages and their Debian source package files. Exact
distribution releases and RPM kernel versions are included in the asset names.
Every .tar.gz bundle has a matching .sha256 file. The complete snapshot is
replaced after each successful package workflow for the current master
commit.
QLogic target driver
Two QLogic target drivers are included in the SCST project.
The default driver is located in the qla2x00t-32gbit directory. It is the newer one.
May anyone wish to switch back to the older driver that only supported up to
16 Gb/s adapters, it is located in qla2x00t directory. To make use of the
older driver build scst with environment variable QLA_32GBIT=no set.
Vladislav Bolkhovitin vst@vlnb.net, http://scst.sourceforge.net
Sourceforge achievements
