title: nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
description: In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
If the host sends an H2CData command with an invalid DATAL,
the kernel may crash in nvmet_tcp_build_pdu_iovec().
Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000000
lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp]
Call trace:
process_one_work+0x174/0x3c8
worker_thread+0x2d0/0x3e8
kthread+0x104/0x110
Fix the bug by raising a fatal error if DATAL isn't coherent
with the packet size.
Also, the PDU length should never exceed the MAXH2CDATA parameter which
has been communicated to the host in nvmet_tcp_handle_icreq().
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 872d26a391da, lessThan: ee5e7632e981, status: affected, versionType: git
version: 872d26a391da, lessThan: f775f2621c2a, status: affected, versionType: git
version: 872d26a391da, lessThan: 4cb3cf7177ae, status: affected, versionType: git
version: 872d26a391da, lessThan: 2871aa407007, status: affected, versionType: git
version: 872d26a391da, lessThan: 24e05760186d, status: affected, versionType: git
version: 872d26a391da, lessThan: 70154e8d015c, status: affected, versionType: git
version: 872d26a391da, lessThan: efa56305908b, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.0, status: affected
version: 0, lessThan: 5.0, status: unaffected, versionType: custom
version: 5.4.268, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.209, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.148, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.75, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.14, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.2, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
