[RFC PATCH 1/2] scsi: be2iscsi: validate vendor request and payload lengths

[BeaCox]

mgmt_vendor_specific_fw_cmd() reads vendor_cmd[0..4], but the iSCSI
BSG transport accepts vendor requests containing only msgcode and
vendor_id. Reject requests shorter than the five command words before
accessing those fields.

The DMA buffer is allocated using request_payload.payload_len. Require
space for be_bsg_vendor_cmd before writing its fields or command header.

Keep nonemb_cmd->size initialized before returning an error because
beiscsi_bsg_request() uses it to free the DMA allocation. Return zero,
the failure sentinel expected by that caller.

The analysis, draft and validation were assisted by OpenAI Codex.

Fixes: ffce3e2e8ce4 ("[SCSI] be2iscsi: Adding bsg interface for be2iscsi")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: BeaCox <0xbeac@xxxxxxxxx>
---
Testing: x86_64 object builds with gcc 13.3 and W=1 for the first patch
and the complete series. A userspace harness extracts the actual driver
function and uses hardware stubs with ASan/UBSan. It detects out-of-bounds
accesses in the original function and passes 2593 boundary cases with
both patches applied, including error cleanup and lock balance.

This is function-level testing, not a kernel/BSG reproducer or HBA test.
No be2iscsi HBA or firmware operation was exercised. The BSG entry point
requires CAP_SYS_RAWIO; no unprivileged exploit is claimed. The local
harness can be shared privately on request.

 drivers/scsi/be2iscsi/be_mgmt.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index b1cba986f0..3b8551a1f0 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -43,6 +43,15 @@ unsigned int mgmt_vendor_specific_fw_cmd(struct be_ctrl_info *ctrl,
 	unsigned short region, sector_size, sector, offset;
 
 	nonemb_cmd->size = job->request_payload.payload_len;
+	if (job->request_len <
+	    offsetof(struct iscsi_bsg_request,
+		     rqst_data.h_vendor.vendor_cmd) + 5 * sizeof(__u32) ||
+	    nonemb_cmd->size < sizeof(*req)) {
+		beiscsi_log(phba, KERN_WARNING, BEISCSI_LOG_CONFIG,
+			    "BG_%d : Invalid vendor request or payload length\n");
+		return 0;
+	}
+
 	memset(nonemb_cmd->va, 0, nonemb_cmd->size);
 	region =  bsg_req->rqst_data.h_vendor.vendor_cmd[1];
 	sector_size =  bsg_req->rqst_data.h_vendor.vendor_cmd[2];
-- 
2.43.0