Re: [PATCH v3 0/3] scsi: libiscsi: validate task lookups driven by target-supplied ITTs

[Martin K. Petersen (Oracle)]

On Wed, 07 Oct 2026 10:58:39 +0900, Yehyeong Lee wrote:

> Three places where an ITT taken from a target-supplied PDU reaches a task
> without being checked. Each is reachable from the wire with one injected
> PDU and each is independently useful, but they share one lookup helper so
> they are sent together.
> 
> 1/3 bounds the index from below. A transport that implements
> parse_pdu_itt can produce a negative one; be2iscsi does, and forwards an
> unsolicited NOP-In from the hardware with the target's ITT intact. I
> have no be2iscsi hardware, so this one is argued from source.
> 
> [...]

Applied to 7.3/scsi-fixes, thanks!

[1/3] scsi: libiscsi: reject a negative task index from parse_pdu_itt
      https://git.kernel.org/mkp/scsi/c/8ee2a09a1dbb
[2/3] scsi: libiscsi: validate the ITT reflected in a Reject PDU
      https://git.kernel.org/mkp/scsi/c/c5958c770b2a
[3/3] scsi: libiscsi: validate the task named by a management response
      https://git.kernel.org/mkp/scsi/c/11bffcd9cb34

-- 
Martin K. Petersen