scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()

[ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ]

The function lio_target_nacl_info_show() uses sprintf() in a loop to print
details for every iSCSI connection in a session without checking for the
buffer length. With enough iSCSI connections it's possible to overflow the
buffer provided by configfs and corrupt the memory.

This patch replaces sprintf() with sysfs_emit_at() that checks for buffer
boundries.

Signed-off-by: Konstantin Shelekhin <k.shelekhin@yadro.com>
Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index 5d0f51822414e04018bfaaf73787d4d09ae53d70..c142a67dc7cc2ae735e4b6ac991aebf7c10cb633 100644 (file)
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -533,102 +533,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page)
        spin_lock_bh(&se_nacl->nacl_sess_lock);
        se_sess = se_nacl->nacl_sess;
        if (!se_sess) {
-               rb += sprintf(page+rb, "No active iSCSI Session for Initiator"
+               rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator"
                        " Endpoint: %s\n", se_nacl->initiatorname);
        } else {
                sess = se_sess->fabric_sess_ptr;
 
-               rb += sprintf(page+rb, "InitiatorName: %s\n",
+               rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n",
                        sess->sess_ops->InitiatorName);
-               rb += sprintf(page+rb, "InitiatorAlias: %s\n",
+               rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n",
                        sess->sess_ops->InitiatorAlias);
 
-               rb += sprintf(page+rb,
+               rb += sysfs_emit_at(page, rb,
                              "LIO Session ID: %u   ISID: 0x%6ph  TSIH: %hu  ",
                              sess->sid, sess->isid, sess->tsih);
-               rb += sprintf(page+rb, "SessionType: %s\n",
+               rb += sysfs_emit_at(page, rb, "SessionType: %s\n",
                                (sess->sess_ops->SessionType) ?
                                "Discovery" : "Normal");
-               rb += sprintf(page+rb, "Session State: ");
+               rb += sysfs_emit_at(page, rb, "Session State: ");
                switch (sess->session_state) {
                case TARG_SESS_STATE_FREE:
-                       rb += sprintf(page+rb, "TARG_SESS_FREE\n");
+                       rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n");
                        break;
                case TARG_SESS_STATE_ACTIVE:
-                       rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n");
+                       rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n");
                        break;
                case TARG_SESS_STATE_LOGGED_IN:
-                       rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n");
+                       rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n");
                        break;
                case TARG_SESS_STATE_FAILED:
-                       rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n");
+                       rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n");
                        break;
                case TARG_SESS_STATE_IN_CONTINUE:
-                       rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n");
+                       rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n");
                        break;
                default:
-                       rb += sprintf(page+rb, "ERROR: Unknown Session"
+                       rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session"
                                        " State!\n");
                        break;
                }
 
-               rb += sprintf(page+rb, "---------------------[iSCSI Session"
+               rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session"
                                " Values]-----------------------\n");
-               rb += sprintf(page+rb, "  CmdSN/WR  :  CmdSN/WC  :  ExpCmdSN"
+               rb += sysfs_emit_at(page, rb, "  CmdSN/WR  :  CmdSN/WC  :  ExpCmdSN"
                                "  :  MaxCmdSN  :     ITT    :     TTT\n");
                max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn);
-               rb += sprintf(page+rb, " 0x%08x   0x%08x   0x%08x   0x%08x"
+               rb += sysfs_emit_at(page, rb, " 0x%08x   0x%08x   0x%08x   0x%08x"
                                "   0x%08x   0x%08x\n",
                        sess->cmdsn_window,
                        (max_cmd_sn - sess->exp_cmd_sn) + 1,
                        sess->exp_cmd_sn, max_cmd_sn,
                        sess->init_task_tag, sess->targ_xfer_tag);
-               rb += sprintf(page+rb, "----------------------[iSCSI"
+               rb += sysfs_emit_at(page, rb, "----------------------[iSCSI"
                                " Connections]-------------------------\n");
 
                spin_lock(&sess->conn_lock);
                list_for_each_entry(conn, &sess->sess_conn_list, conn_list) {
-                       rb += sprintf(page+rb, "CID: %hu  Connection"
+                       rb += sysfs_emit_at(page, rb, "CID: %hu  Connection"
                                        " State: ", conn->cid);
                        switch (conn->conn_state) {
                        case TARG_CONN_STATE_FREE:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "TARG_CONN_STATE_FREE\n");
                                break;
                        case TARG_CONN_STATE_XPT_UP:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "TARG_CONN_STATE_XPT_UP\n");
                                break;
                        case TARG_CONN_STATE_IN_LOGIN:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "TARG_CONN_STATE_IN_LOGIN\n");
                                break;
                        case TARG_CONN_STATE_LOGGED_IN:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "TARG_CONN_STATE_LOGGED_IN\n");
                                break;
                        case TARG_CONN_STATE_IN_LOGOUT:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "TARG_CONN_STATE_IN_LOGOUT\n");
                                break;
                        case TARG_CONN_STATE_LOGOUT_REQUESTED:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "TARG_CONN_STATE_LOGOUT_REQUESTED\n");
                                break;
                        case TARG_CONN_STATE_CLEANUP_WAIT:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "TARG_CONN_STATE_CLEANUP_WAIT\n");
                                break;
                        default:
-                               rb += sprintf(page+rb,
+                               rb += sysfs_emit_at(page, rb,
                                        "ERROR: Unknown Connection State!\n");
                                break;
                        }
 
-                       rb += sprintf(page+rb, "   Address %pISc %s", &conn->login_sockaddr,
+                       rb += sysfs_emit_at(page, rb, "   Address %pISc %s", &conn->login_sockaddr,
                                (conn->network_transport == ISCSI_TCP) ?
                                "TCP" : "SCTP");
-                       rb += sprintf(page+rb, "  StatSN: 0x%08x\n",
+                       rb += sysfs_emit_at(page, rb, "  StatSN: 0x%08x\n",
                                conn->stat_sn);
                }
                spin_unlock(&sess->conn_lock);