Received-SPF: pass (google.com: domain of linux-kernel+bounces-53993-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
To: Fullway Wang <fullwaywang@outlook.com>
Cc: bootc@bootc.net, martin.petersen@oracle.com, linux-scsi@vger.kernel.org,
        target-devel@vger.kernel.org, linux-kernel@vger.kernel.org,
        fullwaywang@tencent.com
Subject: Re: [PATCH] target: sbp: integer overflow and potential memory
 corruption
From: "Martin K. Petersen" <martin.petersen@oracle.com>
Organization: Oracle Corporation
Message-ID: <yq1h6impo5p.fsf@ca-mkp.ca.oracle.com>
References: <PH7PR20MB59258C767EF853A54273B3A7BF712@PH7PR20MB5925.namprd20.prod.outlook.com>
Date: Mon, 05 Feb 2024 17:02:12 -0500
In-Reply-To: <PH7PR20MB59258C767EF853A54273B3A7BF712@PH7PR20MB5925.namprd20.prod.outlook.com>
	(Fullway Wang's message of "Thu, 18 Jan 2024 11:19:59 +0800")
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?Ot9/OSSB6yNZL/ytAVah9uD3xv9B/qmnpcaVKZxXo3b93S2bBRULp5wtrvAj?=
 =?us-ascii?Q?TS4CAWb+oROxRriziAs5gIgWaHNyR5FrP+MO7M4D00J2gCL1TCZKkAQ/XmNA?=
 =?us-ascii?Q?KoFFr4oKj7b3nlDV5ZGEMpTWY7rcVWXvG6XpBRauY49w4ddQ9W8vHJqqCqe0?=
 =?us-ascii?Q?3tbHj/rhJnXzwzZMuiYeS+rH1uVD2OowdpDZG/V2rCYvL30oPpb/bGGeMBck?=
 =?us-ascii?Q?6hFO6DAytMSDX5uM5NfJ/XeCFRt4rg+4HrZ0nHyag1iKqKGEwUFq0bCMxVMV?=
 =?us-ascii?Q?JCF4CAPifyc6Zdemk8y79gOhBnldDYgqyqcAcs/yOXxOys1KXi0+fks/5RGJ?=
 =?us-ascii?Q?NidmqlqD7jjEWIHsUOU5SkHQflCZeuo6j6ixikYZemeu8WQO2jpVGRu4z4JO?=
 =?us-ascii?Q?ggY54Bfb5jgofGUAcz5R2rFYl/FFNcxUsCDQpNWstnDAfZwgpwqlnfILFjE1?=
 =?us-ascii?Q?W10DH92qFnM1tGka+4XpHxjkZo7Fqc18SR9kcirAWQ7TGgOpw6dQq62Zqj9Q?=
 =?us-ascii?Q?V4uN8NnhXGrKqYL7bY56W8p5k+M/DoDivrc9dQVS2HT2kgPsRF8bmPvC9bin?=
 =?us-ascii?Q?5iW5pBEt9Gwb8nYdq+Q0SS9n0jE+5qwOBOmDVqGYMUQw+ufP2HkRmwTATh2b?=
 =?us-ascii?Q?SEPg5wvqIX/SxsO1+XI8kz2cO7Sbw1FZ4/oWfMrde966GmS4ZVr883cNy++7?=
 =?us-ascii?Q?PQRZ5jU4Lr4AxL6n1k8sU8l2PvbJsqTLw7/b1xKyl/KUS4caUFe7woj3/DnJ?=
 =?us-ascii?Q?xQhXtWHS4T7EU/c0wEo801rxQd+/x3DTQCz97c8v8HCZwKMXIL6RjcW+UMyD?=
 =?us-ascii?Q?uKb0wyOieC1M3vMBgB+h1m78tjWfPz2pCjtK0vEB0LthCHZzYjlRaathqMMI?=
 =?us-ascii?Q?0winhHS+SqHs+U5pspDqh10xN2N+6YNWBvZCbvDlZ4E/YpuDqg3iAt1SUf78?=
 =?us-ascii?Q?HcYzEuPbb6nEpjEoa06JkqigTpS11EW7qwGUvWbqZoplAwTsSsgRAyupd2Cp?=
 =?us-ascii?Q?UylLLOc1totFSL292cr8k+SW6umdCDmKnBesK8Q6Cf3Y2FQyPLZXjSDA/NEo?=
 =?us-ascii?Q?URcRrq+clASkgvR93NbGZiGgU0+hwOJxAVOQD5Cp0XlI0FM2vVvcCtVVVOeF?=
 =?us-ascii?Q?FNM8lTP0N7g3v2bcs9Ls2QYdU5jev0a8Sgcnnz/jQWypGn+SpUDvMsERmRf+?=
 =?us-ascii?Q?ffqJcGG5iKJsciWkF0Yo0odaaNv0rhVg4esrUzykKY5vxHpIbSJP+PqBtqLC?=
 =?us-ascii?Q?oaG/bRK5GyEzXDDFJSavoJWWBOeItSarOMdlN1PPjFdE5D2vf8Dms1y0zV/0?=
 =?us-ascii?Q?F7RaWF4gHXcLeL14fWLGqar9z5tih/j8yjNG1D1ok6uCfsL/pyGuwc6hiTfl?=
 =?us-ascii?Q?Lex68l2GBCKlk4lazsv4gApDcqx05YmFVmk1SKN/bCunk7TjcdM1lqfs6yDt?=
 =?us-ascii?Q?2u8kgyKBWF/TWiQe5pXlMAsnhdsVazNcXhKZux6wMqQmje3C8tXLk/y2mMTj?=
 =?us-ascii?Q?XLbpE+DT/E6SVA9gtG+lM3jwNN3WbJncTh43BS62z9VPo102vwNhp7BgE1bM?=
 =?us-ascii?Q?sAIbeetZdBQTZU7gB8WO/yuOxDcdd9MOvmmAAeIn2Iw5O/mzyOKrnbNJxUQ7?=
 =?us-ascii?Q?Kw=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	oju4IQD5VANITSTE7hW4ZPxlRWd5fmR2brWkFl+4UEjxSIUc574Vsg35QaOfLqBwJWTR6Lur78mbLrdowJuya5TxCSFRY+utGauU5Lw2s4JQDGKVKI8V2SDbFALfinVaYhVMMlZ/Fk8gXZra3/jQXi/02prZesU0HwBTTv+vl1kOhGFByFZFEn1QdAEJZZLAP0AIPMfzTVM2+y3/g/Xg8ldEOXUN27xw+TpdLwdH2FwULodv3dJ4Fvp0Ou+aJnxdDPXrDqpzfX8Ty5BYWyJNdcpwz+zj+1jkbub1YAFyXUXqWxyVUVjAS0X6064yEZdHVDGGpxga8C/KFlrYVK90G7n+Xmw3JDFNFi9Jj+/6WhL6/qxc2YLO3AVbszT/DY4xgcJbJo30OZ0kfv5i2QSAcrYOi/aj7VF6DDn0stqp5Cq9qBFaHlooA6q3tY/cx6UJmPL9dFnaBGU8LRu1TjFcwplq150OHTN8GaHvO4MRfca/OIffu7rJxuZRRNwqEKSR/8dnNMo/XsraFgwxCSBumMZl2L7bM2UskIFCtdvHhkkkQ5tZ7SaENRUHUPhucr6L8foz/+ansLYRUERRtd3RX+oe/2vhQDxeBBDjCkrCzTM=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5b4f1be7-ee2d-4fc4-6ae7-08dc26961c93
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Feb 2024 22:02:14.7027
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 5aBIR3b5FXY1njpbFs0/uL2nkjLBxwGmvq1qVF5dAz3hhh8G6dlHTAiFr8FIsIDZd63wbV32IQblahEE0pcUX3Q0zI6k3FzzPx0MjzXWp6Y=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR10MB5888
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-02-05_16,2024-01-31_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0
 mlxlogscore=521 phishscore=0 spamscore=0 mlxscore=0 adultscore=0
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2311290000 definitions=main-2402050165
X-Proofpoint-ORIG-GUID: pCs-7oOZwC2IN6YgwwGI9l7qy-vHFVjT
X-Proofpoint-GUID: pCs-7oOZwC2IN6YgwwGI9l7qy-vHFVjT


Fullway,

> The code in sbp_make_tpg() is confusing because tpgt was limited
> to UINT_MAX but the datatype of tpg->tport_tpgt is actually u16.
> Correctly fix the data type problem to avoid integer overflow.
>
> This is similar to CVE-2015-4036 in the sense that sbp is a clone
> of vhost/scsi, and the bug was inherited but never fixed.

> +#define SBP_MAX_TARGET	256

Why 256?

-- 
Martin K. Petersen	Oracle Linux Engineering