[PATCH] scsi: libiscsi_tcp: prevent R2T range check overflow

[PATCH] scsi: libiscsi_tcp: prevent R2T range check overflow

[Ratnaker Gautam]

An iSCSI target controls the R2T data offset and length as 32-bit
values. Adding them before comparing the result with the SCSI data
buffer length can wrap. An R2T with offset 1 and length U32_MAX then
passes the check for a 4096-byte write.

The transmit path treats the wrapped range as valid, exhausts the
command scatterlist, and dereferences the NULL next entry in
iscsi_tcp_segment_done().

Check the offset first, then compare the length with the remaining
bytes in the data buffer.

Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld")
Cc: stable@vger.kernel.org
Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
---
 drivers/scsi/libiscsi_tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index d35f93451ee9b..3c9e736d45e7e 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -601,7 +601,8 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
 			      data_length, session->max_burst);
 
 	data_offset = be32_to_cpu(rhdr->data_offset);
-	if (data_offset + data_length > task->sc->sdb.length) {
+	if (data_offset > task->sc->sdb.length ||
+	    data_length > task->sc->sdb.length - data_offset) {
 		iscsi_conn_printk(KERN_ERR, conn,
 				  "invalid R2T with data len %u at offset %u "
 				  "and total length %d\n", data_length,
-- 
2.43.0

Re: [PATCH] scsi: libiscsi_tcp: prevent R2T range check overflow

[Chris Leech]

On Mon, Oct 19, 2026 at 09:30:33PM +0000, Ratnaker Gautam wrote:
> An iSCSI target controls the R2T data offset and length as 32-bit
> values. Adding them before comparing the result with the SCSI data
> buffer length can wrap. An R2T with offset 1 and length U32_MAX then
> passes the check for a 4096-byte write.
> 
> The transmit path treats the wrapped range as valid, exhausts the
> command scatterlist, and dereferences the NULL next entry in
> iscsi_tcp_segment_done().
> 
> Check the offset first, then compare the length with the remaining
> bytes in the data buffer.
> 
> Fixes: a081c13e39b5 ("[SCSI] iscsi_tcp: split module into lib and lld")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ratnaker Gautam <ratnaker.gautam@kuleuven.be>
> ---
>  drivers/scsi/libiscsi_tcp.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
> index d35f93451ee9b..3c9e736d45e7e 100644
> --- a/drivers/scsi/libiscsi_tcp.c
> +++ b/drivers/scsi/libiscsi_tcp.c
> @@ -601,7 +601,8 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
>  			      data_length, session->max_burst);
>  
>  	data_offset = be32_to_cpu(rhdr->data_offset);
> -	if (data_offset + data_length > task->sc->sdb.length) {
> +	if (data_offset > task->sc->sdb.length ||
> +	    data_length > task->sc->sdb.length - data_offset) {
>  		iscsi_conn_printk(KERN_ERR, conn,
>  				  "invalid R2T with data len %u at offset %u "
>  				  "and total length %d\n", data_length,
> -- 

Acked-by: Chris Leech <cleech@redhat.com>

Re: [PATCH] scsi: libiscsi_tcp: prevent R2T range check overflow

[Martin K. Petersen]

Ratnaker,

> An iSCSI target controls the R2T data offset and length as 32-bit
> values. Adding them before comparing the result with the SCSI data
> buffer length can wrap. An R2T with offset 1 and length U32_MAX then
> passes the check for a 4096-byte write.

Applied to 7.4/scsi-staging, thanks!

-- 
Martin K. Petersen