Re: [PATCH v3 1/2] scsi: bsg: fix TOCTOU in io_uring passthrough command setup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The completion callback writes out-of-bounds to user space by failing to cap `sense_len` with `max_response_len`.
--

--- Patch [1]: [PATCH v3 1/2] scsi: bsg: fix TOCTOU in io_uring passthrough command setup ---
commit 2cc4e90253ec0a7b16f7c596b055fcc02296f149
Author: Rahul Chandelkar <rc@rexion.ai>

scsi: bsg: fix TOCTOU in io_uring passthrough command setup

This commit addresses a TOCTOU vulnerability by reading bsg_uring_cmd
fields from the shared mmap'd SQE into local variables once before use.
This ensures bounds checks cannot be bypassed if userspace changes the
values concurrently.

Link: https://lore.kernel.org/r/20260527105931.3950913-1-rc@rexion.ai

> diff --git a/drivers/scsi/scsi_bsg.c b/drivers/scsi/scsi_bsg.c
> index e80dec53174ea..7758c5f22a7e9 100644
> --- a/drivers/scsi/scsi_bsg.c
> +++ b/drivers/scsi/scsi_bsg.c

[ ... ]

> @@ -155,11 +161,17 @@ static int scsi_bsg_uring_cmd(struct request_queue *q, struct io_uring_cmd *iouc
>  	}
>  
>  	pdu->response_addr = cmd->response;
> -	scmd->sense_len = cmd->max_response_len ?
> -		min(cmd->max_response_len, SCSI_SENSE_BUFFERSIZE) : SCSI_SENSE_BUFFERSIZE;
> +	scmd->sense_len = max_response_len ?
> +		min(max_response_len, SCSI_SENSE_BUFFERSIZE) : SCSI_SENSE_BUFFERSIZE;

[Severity: High]
This isn't a bug introduced by this patch, but the completion logic in
scsi_bsg_uring_task_cb() contains a buffer overflow vulnerability affecting
user space.

When a command completes with a check condition, the SCSI core in
scsi_io_completion_nz_result() overwrites scmd->sense_len with the actual
length of the sense data.

Later in scsi_bsg_uring_task_cb(), the code calculates the write length:

	sense_len_wr = min_t(u8, scmd->sense_len,
			     SCSI_SENSE_BUFFERSIZE);
	...
	if (copy_to_user(uptr64(pdu->response_addr), scmd->sense_buffer,
			 sense_len_wr))

Since max_response_len was only stored in scmd->sense_len (which was
overwritten) and not saved in the PDU, the kernel uses the unbounded sense
data length.

Can this copy unbounded sense data to user space, overflowing the provided
buffer if the sense data exceeds the original max_response_len?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260817013959.165425-1-yangxiuwei@kylinos.cn?part=1