scsi: target: validate REGISTER AND MOVE TransportID length

REGISTER AND MOVE has a 24-byte parameter-list header followed by a TransportID. A 24-byte parameter list with a zero TransportID length passes the existing tid_len + 24 check, then the handler reads buf[24] for the TransportID protocol identifier, one byte past the received parameter list.

A TransportID is at least 24 bytes. Reject shorter TransportIDs and compare the declared length with the bytes following the header before reading buf[24].

A malformed PR OUT sent through vhost-scsi triggered this read on a KASAN kernel. The command is now rejected with INVALID PARAMETER LIST before buf[24] is accessed.

---
 drivers/target/target_core_pr.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

index 25b1bcacc0c8..ca1a2802aa22 100644
@@ -3226,10 +3226,11 @@ core_scsi3_emulate_pro_register_and_move(struct se_cmd *cmd, u64 res_key,
 	transport_kunmap_data_sg(cmd);
 	buf = NULL;
 
-	if ((tid_len + 24) != cmd->data_length) {
-		pr_err("SPC-3 PR: Illegal tid_len: %u + 24 byte header"
-			" does not equal CDB data_length: %u\n", tid_len,
-			cmd->data_length);
+	/* TransportID is at least 24 bytes. buf[24] is its first byte. */
+	if (tid_len < 24 ||
+	    tid_len != cmd->data_length - 24) {
+		pr_err("SPC-3 PR: Illegal tid_len: %u for data_length: %u\n",
+		       tid_len, cmd->data_length);
 		ret = TCM_INVALID_PARAMETER_LIST;
 		goto out_put_pr_reg;
 	}

Jia,

Applied to 7.4/scsi-staging, thanks!

Martin K. Petersen