[PATCH 1/1] scsi: target: Skip zero-length protection SG allocation

[liuyong]

A READ(10) command with its TRANSFER LENGTH field set to zero, sent to a
LUN with protection information enabled, can select TARGET_PROT_DIN_STRIP
while leaving cmd->prot_length at zero. transport_generic_new_cmd() then
passes that zero length to target_alloc_sgl(). This reaches
sg_init_table() with no entries, so sg_init_marker() accesses an invalid
last entry and causes a target-side Oops, which can also lead to
use-after-free during subsequent iSCSI connection cleanup. A logged-in
iSCSI initiator can trigger this on a FILEIO LUN with protection
information enabled.

Require a nonzero protection length before allocating its SG list,
allowing commands with no protection payload to proceed without an
empty allocation.

These issues were discovered and fixed by Qihoo 360's Tulongfeng
multi-agent system.

Fixes: 5835812f13e5 ("target: ensure se_cmd->t_prot_sg is allocated when required")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: liuyong <pkfxxxing@xxxxxxxxx>
---
 drivers/target/target_core_transport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 927861c30..4cda1e610 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2841,7 +2841,7 @@ transport_generic_new_cmd(struct se_cmd *cmd)
 	int ret = 0;
 	bool zero_flag = !(cmd->se_cmd_flags & SCF_SCSI_DATA_CDB);
 
-	if (cmd->prot_op != TARGET_PROT_NORMAL &&
+	if (cmd->prot_length && cmd->prot_op != TARGET_PROT_NORMAL &&
 	    !(cmd->se_cmd_flags & SCF_PASSTHROUGH_PROT_SG_TO_MEM_NOALLOC)) {
 		ret = target_alloc_sgl(&cmd->t_prot_sg, &cmd->t_prot_nents,
 				       cmd->prot_length, true, false);

base-commit: f66469d9905b39d2c260a15d7d6db450f4db67c1