[PATCH v2] scsi: target: Disable protection processing for zero-block commands

[yong liu]

A READ(10) with its TRANSFER LENGTH field set to zero on a PI-enabled
LUN can select TARGET_PROT_DIN_STRIP while leaving cmd->prot_length at
zero. transport_generic_new_cmd() then allocates an empty protection
scatterlist, causing a target-side Oops, which can also lead to
use-after-free during subsequent iSCSI connection cleanup. A logged-in
iSCSI initiator can trigger this on a FILEIO LUN with protection
information enabled.

After validating PROTECT, reset the protection operation, type and
checks for zero-block commands in sbc_check_prot(). This avoids the
empty allocation and prevents backends and fabrics from selecting PI
processing without a protection payload. Preserve the existing
data-length adjustment for commands carrying PI over the wire.

The issue was discovered and fixed by Qihoo 360's Tulongfeng multi-agent
system.

Fixes: 5835812f13e5 ("target: ensure se_cmd->t_prot_sg is allocated when required")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: yong liu <pkfxxxing@xxxxxxxxx>
---
Changes in v2 (addressing sashiko-bot's protection-state review):
- Replace the allocation-only guard with a zero-block protection state fix
  in sbc_check_prot(), so backends and fabrics do not select PI processing
  without a protection payload.
- Preserve PROTECT validation and the existing data-length adjustment.

Developed against f66469d9905b39d2c260a15d7d6db450f4db67c1 (7.4-rc1).

 drivers/target/target_core_sbc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 21f5cb86d7..560e62cef7 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -721,6 +721,12 @@ sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char protect,
 	if (sbc_set_prot_op_checks(protect, fabric_prot, pi_prot_type, is_write, cmd))
 		return TCM_INVALID_CDB_FIELD;
 
+	if (!sectors) {
+		cmd->prot_op = TARGET_PROT_NORMAL;
+		cmd->prot_checks = 0;
+		pi_prot_type = TARGET_DIF_TYPE0_PROT;
+	}
+
 	cmd->prot_type = pi_prot_type;
 	cmd->prot_length = dev->prot_length * sectors;
 
-- 
2.43.0