CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: Bound PR-OUT TransportID parsing to the received buffer

core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move()
hand the raw PERSISTENT RESERVE OUT parameter buffer to
target_parse_pr_out_transport_id() without telling it how many bytes are
valid.  For an iSCSI TransportID (FORMAT CODE 01b),
iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with
an unbounded strstr() (and on the error path prints the name with a further
unbounded "%s").  An initiator can submit a TransportID whose iSCSI name
contains neither a ",i,0x" substring nor a NUL terminator, filling the
parameter list to its end, so the scan runs off the end of the buffer.

When the parameter list spans more than one page the buffer is a multi-page
vmap (transport_kmap_data_sg()), so the over-read walks into the trailing
vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr).  It
is reachable by any fabric that delivers a PR OUT to a device exported
through an iSCSI TPG, including a guest via vhost-scsi.

Pass the number of received bytes down to the parser and validate the iSCSI
TransportID's own self-described length (ADDITIONAL LENGTH + 4) once, up
front: reject it if it is below the spc4r17 minimum or larger than the
received buffer, then bound the separator search, the ISID walk and the
name copy by that length.  This is the length check the callers already
perform after the parse (core_scsi3_decode_spec_i_port() compares tid_len
against tpdl, core_scsi3_emulate_register_and_move() validates it against
data_length), moved ahead of the scan.  Also drop the unbounded "%s" of the
unterminated name.

Add per-format explicit name-length checks before copying into i_str,
rather than silently truncating with min_t: for FORMAT CODE 00b reject if
the descriptor body (tid_len - 4 bytes) cannot fit in
i_str[TRANSPORT_IQN_LEN]; for FORMAT CODE 01b reject if the name portion
(from &buf[4] up to the separator) cannot fit.  Both checks make the bounds
intent explicit at each format branch.

While here, also reject a FORMAT CODE 01b TransportID whose ",i,0x"
separator sits at the very end of the descriptor: that leaves an empty ISID
and points the returned port nexus pointer at buf + tid_len, one past the
descriptor, which the registration code (__core_scsi3_locate_pr_reg(),
__core_scsi3_alloc_registration()) then dereferences as the ISID string --
the same over-read of the parameter buffer for a malformed descriptor.

The Linux kernel CVE team has assigned CVE-2026-72084 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.38 with commit c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 and fixed in 5.15.212 with commit 842248047ef28dbf3b3f7f49a0ec315054d4dab8
	Issue introduced in 2.6.38 with commit c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 and fixed in 6.1.178 with commit 03fbc7de8d5e85fc8420e57e8304c855efd453ab
	Issue introduced in 2.6.38 with commit c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 and fixed in 6.6.145 with commit 6ca5de8782e67573a61a6736b6dc0ffe58dcdf59
	Issue introduced in 2.6.38 with commit c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 and fixed in 6.12.97 with commit 9298078a8f7d8181a04614a34ab655ccdf038204
	Issue introduced in 2.6.38 with commit c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 and fixed in 6.18.40 with commit 004ccd2d3b4ac36a300e05e01df152e5c02a5a82
	Issue introduced in 2.6.38 with commit c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 and fixed in 7.1.5 with commit 555a89846ed888d7401b3f7200934c0fbedcbb46
	Issue introduced in 2.6.38 with commit c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 and fixed in 7.2-rc4 with commit d04a179085c262c9ed577d0a4cbc6482ff1fd9a3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72084
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/target/target_core_fabric_lib.c
	drivers/target/target_core_internal.h
	drivers/target/target_core_pr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/842248047ef28dbf3b3f7f49a0ec315054d4dab8
	https://git.kernel.org/stable/c/03fbc7de8d5e85fc8420e57e8304c855efd453ab
	https://git.kernel.org/stable/c/6ca5de8782e67573a61a6736b6dc0ffe58dcdf59
	https://git.kernel.org/stable/c/9298078a8f7d8181a04614a34ab655ccdf038204
	https://git.kernel.org/stable/c/004ccd2d3b4ac36a300e05e01df152e5c02a5a82
	https://git.kernel.org/stable/c/555a89846ed888d7401b3f7200934c0fbedcbb46
	https://git.kernel.org/stable/c/d04a179085c262c9ed577d0a4cbc6482ff1fd9a3