vhost_scsi_handle_vq() moves pi_bytesout or pi_bytesin into the
protection sgl and subtracts those bytes from exp_data_len. The length
passed to TCM is still exp_data_len + prot_bytes.
prot_bytes comes from virtio_scsi_cmd_req_pi. With
VIRTIO_SCSI_F_T10_PI negotiated, vhost reads that header and does not
check that the CDB is a READ or WRITE. sbc_check_prot() replaces
data_length from the CDB only when the protect field is non-zero.
target_cmd_size_check() leaves a write's data_length unchanged when the
CDB size is smaller, so a command that does not get that replacement
keeps a data_length larger than the data sgl.
The KASAN report is a MODE SELECT whose header had pi_bytesout set.
The data sgl held only the parameter list. spc_emulate_modeselect()
walked data_length and read the next physical page.
Pass the data sgl length. Protected READ and WRITE still take their
length from the CDB in sbc_check_prot().
KASAN reports:
BUG: KASAN: use-after-free in spc_emulate_modeselect+0x145/0x380
[target_core_mod]
Read of size 1
spc_emulate_modeselect
__target_execute_cmd
target_execute_cmd
vhost_scsi_write_pending
transport_generic_new_cmd
__target_submit
target_queued_submit_work
process_one_work
worker_thread
kthread
ret_from_fork
ret_from_fork_asm
Fixes: 9f977ef7b671 ("vhost-scsi: Include prot_bytes into expected data
transfer length")
Signed-off-by: Jia Jia <[email protected]>
---
v2:
- Drop the claim that target used to subtract prot_length.
9f977ef7b671 cites 14ef9200, which is not in the tree
- prot_bytes comes from virtio_scsi_cmd_req_pi
drivers/vhost/scsi.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4f8c0260bc9e..4bd29c2ceed9 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1534,9 +1534,13 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct
vhost_virtqueue *vq)
* vhost_scsi_queue_data_in() and vhost_scsi_queue_status()
*/
cmd->tvc_vq_desc = vc.head;
+ /*
+ * exp_data_len is the data sgl. prot_bytes already sit in
+ * the protection sgl. Protected READ and WRITE replace
+ * data_length from the CDB in sbc_check_prot().
+ */
vhost_scsi_target_queue_cmd(nexus, cmd, cdb, lun, task_attr,
- data_direction,
- exp_data_len + prot_bytes);
+ data_direction, exp_data_len);
ret = 0;
err:
/*
--
2.53.0
