linux-kernel - [PATCH v2] scsi: be2iscsi: Add nla_len check after nla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed,  9 Aug 2023 11:29:18 +0800
From:   Lin Ma <linma@....edu.cn>
To:     ketan.mukadam@...adcom.com, jejb@...ux.ibm.com,
        martin.petersen@...cle.com, michaelc@...wisc.edu,
        JBottomley@...allels.com, jayamohan.kallickal@...lex.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     Lin Ma <linma@....edu.cn>
Subject: [PATCH v2] scsi: be2iscsi: Add nla_len check after nla_find

The previous commit discussed at link
https://lore.kernel.org/all/20230723075938.3713864-1-linma@zju.edu.cn/
adds length checks for the manual parsing loop in
function beiscsi_iface_set_param(..) hence ensures the attribute being
parsed has a valid length.

However, the child function of beiscsi_iface_set_param,
beiscsi_iface_config_ipv4 calls nla_find to locate and parse attributes
ISCSI_NET_PARAM_IPV4_ADDR and ISCSI_NET_PARAM_IPV4_SUBNET. That is, if
these two attributes are placed after the ISCSI_NET_PARAM command, they
can bypass the added check and still cause an out-of-attribute access.

Add extra nla_len checks after those two call sites to nla_find to keep
malformed attributes away.

Fixes: 0e43895ec1f4 ("[SCSI] be2iscsi: adding functionality to change network settings using iscsiadm")
Signed-off-by: Lin Ma <linma@....edu.cn>
---
v1 -> v2: resent because the mail failed to reach public list

 drivers/scsi/be2iscsi/be_iscsi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c
index 8aeaddc93b16..acd3e587455b 100644
--- a/drivers/scsi/be2iscsi/be_iscsi.c
+++ b/drivers/scsi/be2iscsi/be_iscsi.c
@@ -374,7 +374,7 @@ beiscsi_iface_config_ipv4(struct Scsi_Host *shost,
 	case ISCSI_NET_PARAM_IPV4_ADDR:
 		ip = info->value;
 		nla = nla_find(data, dt_len, ISCSI_NET_PARAM_IPV4_SUBNET);
-		if (nla) {
+		if (nla && nla_len(nla) >= sizeof(*info)) {
 			info = nla_data(nla);
 			subnet = info->value;
 		}
@@ -388,7 +388,7 @@ beiscsi_iface_config_ipv4(struct Scsi_Host *shost,
 		 */
 		subnet = info->value;
 		nla = nla_find(data, dt_len, ISCSI_NET_PARAM_IPV4_ADDR);
-		if (nla) {
+		if (nla && nla_len(nla) >= sizeof(*info)) {
 			info = nla_data(nla);
 			ip = info->value;
 		}
-- 
2.17.1