[PATCH v3 0/3] scsi: libiscsi: validate task lookups driven by target-supplied ITTs

[Yehyeong Lee]

Three places where an ITT taken from a target-supplied PDU reaches a task
without being checked. Each is reachable from the wire with one injected
PDU and each is independently useful, but they share one lookup helper so
they are sent together.

1/3 bounds the index from below. A transport that implements
parse_pdu_itt can produce a negative one; be2iscsi does, and forwards an
unsolicited NOP-In from the hardware with the target's ITT intact. I
have no be2iscsi hardware, so this one is argued from source.

2/3 is the ITT reflected in a Reject PDU.

3/3 is the same defect at the lookup that five management responses
share. An unsolicited NOP-In naming an unused index dereferences a NULL
task->conn; a Text Response with the same ITT crashes a little later in
iscsi_complete_task().

Measured on 7.2-rc5 with KASAN over a proxy that injects one PDU. Five
attack shapes oops or warn unpatched and none of them do with the
series. Normal I/O, an abort TMF, a rejected NOP-Out ping, a userspace
nop sent over netlink and an iscsid-driven session are unchanged.

v3: 2/3 - initialise task at its declaration per Mike Christie's review.
    No functional change: the .text of libiscsi.o is byte-identical
    before and after. Picked up Mike Christie's Reviewed-by on all three
    patches.
v2: https://lore.kernel.org/all/20260804040546.2264137-1-yhlee@xxxxxxxxxxxxxxxxxx/
v1: https://lore.kernel.org/all/20260803104149.2114414-1-yhlee@xxxxxxxxxxxxxxxxxx/

Yehyeong Lee (3):
  scsi: libiscsi: reject a negative task index from parse_pdu_itt
  scsi: libiscsi: validate the ITT reflected in a Reject PDU
  scsi: libiscsi: validate the task named by a management response

 drivers/scsi/libiscsi.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)


base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
-- 
2.43.0