Re: [PATCH] scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

[Martin K. Petersen (Oracle)]

On Fri, 04 Sep 2026 13:54:37 +0000, Alberto Carboneri wrote:

> scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the
> ATA feature mode page in a 64-byte stack buffer. A target can report a
> total length shorter than its mode header and block descriptors. The
> unsigned subtraction used for the MODE SELECT length can wrap, and the
> separately computed buf_data can point beyond buf.
> 
> During automatic scan, enable is false, so the read-modify-write of
> buf_data[4] can clear the low two bits of a target-selected out-of-bounds
> stack byte. scsi_mode_select() can then copy up to 64 bytes from outside
> the buffer into the outgoing MODE SELECT payload, disclosing stack contents
> to the target.
> 
> [...]

Applied to 7.3/scsi-fixes, thanks!

[1/1] scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
      https://git.kernel.org/mkp/scsi/c/3d676e458fe0

-- 
Martin K. Petersen