[PATCH] scsi: target: fix PRIN READ_FULL_STATUS buffer bounds check

["Tianchu Chen" <tianchu.chen@linux.dev>]

From: Tianchu Chen <flynnnchen@tencent.com>

core_scsi3_pri_read_full_status() writes one Full Status descriptor
per registered I_T nexus into the PRIN response buffer: a fixed
24-byte descriptor header followed by the variable-length
TransportID.  The overflow check, however, compares

	exp_desc_len + add_len > cmd->data_length

where exp_desc_len covers only the TransportID and add_len
accumulates only after completed descriptors, so it undershoots the actual
write extent by a constant 32 bytes (the 8-byte PRIN header, since
off = add_len + 8, plus the 24-byte descriptor header), leading a
remotely-triggerable heap OOB-write.

The allocation length of the PERSISTENT RESERVE IN CDB is fully
controlled by the (possibly remote) initiator and truncates
cmd->data_length, so an initiator that registered itself can pick a
data_length in [desc_len, desc_len + 31] and make the first
descriptor write up to 32 bytes past the end of the command's data
buffer.

Base the check on the actual write offset instead, so the test
covers exactly what the loop is about to write (24-byte descriptor
header plus TransportID, matching add_desc_len = 24 + desc_len
below), as core_scsi3_pri_read_keys() already does. Same principle
as commit c58a252beb04c ("target: fix buffer offset in
core_scsi3_pri_read_full_status").

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Fixes: c66ac9db8d4ad ("[SCSI] target: Add LIO target core v4.0.0-rc6")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
---
 drivers/target/target_core_pr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 25b1bcacc0c8f..1d34887e9e845 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -3990,7 +3990,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
 		exp_desc_len = target_get_pr_transport_id_len(se_nacl, pr_reg,
 					&format_code);
 		if (exp_desc_len < 0 ||
-		    exp_desc_len + add_len > cmd->data_length) {
+		    off + 24 + exp_desc_len > cmd->data_length) {
 			pr_warn("SPC-3 PRIN READ_FULL_STATUS ran"
 				" out of buffer: %d\n", cmd->data_length);
 			spin_lock(&pr_tmpl->registration_lock);
-- 
2.51.0