Re: [PATCH v2] scsi: libiscsi_tcp: bound SCSI Response data segment to the connection buffer

[Martin K. Petersen]

On Thu, 16 Jul 2026 15:58:48 +0900, HyeongJun An wrote:

> iscsi_tcp_hdr_dissect() receives the data segment of several PDU types
> into the fixed-size conn->data buffer, which is allocated for
> ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes.  For the LOGIN_RSP, TEXT_RSP,
> REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU
> whose DataSegmentLength exceeds that buffer.
> 
> The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its
> data segment (sense/response data) into conn->data via
> iscsi_tcp_data_recv_prep(), but it does so without the same check.  The
> only upstream bound on in.datalen is conn->max_recv_dlength, the
> initiator's advertised MaxRecvDataSegmentLength, which is commonly
> negotiated well above 8192 (open-iscsi defaults to 262144).  A target
> that returns a SCSI Response with a DataSegmentLength between 8193 and
> max_recv_dlength therefore overflows the 8192-byte conn->data buffer.
> 
> [...]

Applied to 7.2/scsi-fixes, thanks!

[1/1] scsi: libiscsi_tcp: bound SCSI Response data segment to the connection buffer
      https://git.kernel.org/mkp/scsi/c/c1dea15f819c

-- 
Martin K. Petersen