From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 084C3273D6B; Mon, 13 Oct 2025 14:47:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760366862; cv=none; b=QC0ykVKjD7CMJUB4+6DaYneZOlydvMFF9WcrIBN5T7Q9Z24wT11j+qDv8xsQ1JgI7yjMNmKjNGa5WBxw8TxordSyZHyTEM6TqP9xqQYvo4l2cyaw9ykXPbwnJ+WdbSLfpw7NXUmDSULMGUPl01FmHdkBuoav/EGQ7xlp1X7n02I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760366862; c=relaxed/simple; bh=RjOEXcl0Wux6GVKIPupxMPAFyb3AOOSo8hxnZzEWerU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WUydS9k+nHh19v0WZTosZYyt2eDXdde6rw78h966STVLGpMbNLNOtsWk7J8jMkx1PtQnIoo1tipXMXPO9RJEbsXoqWNJAULh9466v+Tvf7zXCi+t2mw1MNo8wTuBF44w93xbQeXS9UYB1porso++JWeFhdgxaLWZTXqSFYDCMYU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XsSkjW1f; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="XsSkjW1f" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 428C2C4CEE7; Mon, 13 Oct 2025 14:47:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1760366861; bh=RjOEXcl0Wux6GVKIPupxMPAFyb3AOOSo8hxnZzEWerU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XsSkjW1fTblnK8abcub4HKULYdwX3uz641j7TyTPtKtWQoVg/OaLHAQu2ZrBjoIi3 IfDRcFlaq1yB8Xp/isQsYsPPGrdeBmcX00l4c7dAM2T8qsax7t34O6WEi4uBOU62Yg 7i/+3RWGAqrczjAXxZYz08KeXK2lHkGsCemlvfA8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Wang Haoran , ziiiro , "Martin K. Petersen" Subject: [PATCH 6.1 010/196] scsi: target: target_core_configfs: Add length check to avoid buffer overflow Date: Mon, 13 Oct 2025 16:43:03 +0200 Message-ID: <20251013144314.935141716@linuxfoundation.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251013144314.549284796@linuxfoundation.org> References: <20251013144314.549284796@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wang Haoran commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream. A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes). snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes. Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error. An additional check of the return value of snprintf() can avoid this buffer overflow. Reported-by: Wang Haoran Reported-by: ziiiro Signed-off-by: Wang Haoran Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman --- drivers/target/target_core_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/target/target_core_configfs.c +++ b/drivers/target/target_core_configfs.c @@ -2691,7 +2691,7 @@ static ssize_t target_lu_gp_members_show config_item_name(&dev->dev_group.cg_item)); cur_len++; /* Extra byte for NULL terminator */ - if ((cur_len + len) > PAGE_SIZE) { + if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) { pr_warn("Ran out of lu_gp_show_attr" "_members buffer\n"); break;