CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: reject login PDUs declaring more data than was received

isertloginrecvdone() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares. isertrxloginreq() copies min(loginreqlen, MAXKEYVALUEPAIRS) bytes into login->reqbuf, and the login code then reads the declared length back out of that buffer - for the first PDU in iscsitargetlocateportal(),

payloadlength = ntoh24(loginreq->dlength); tmpbuf = kmemdupnul(login->reqbuf, payloadlength, GFPKERNEL);

and for the ones after it in iscsidecodetextinput(), reached from iscsitargetdologin().

login->reqbuf is a fixed MAXKEYVALUEPAIRS (8192) byte allocation, so an initiator that declares more than it sends reads off the end of it, before authentication and with the length under its control:

BUG: KASAN: slab-out-of-bounds in kmemdupnul+0x43/0x80 Read of size 8193 at addr ffff8881056a8000 by task iscsinp/167 asanmemcpy+0x23/0x60 kmemdupnul+0x43/0x80 iscsitargetlocateportal+0x48d/0x1180 iscsitargetloginthread+0x19a9/0x3350 Allocated by task 167: kmalloccachenoprof+0x158/0x370 iscsitargetloginthread+0x971/0x3350 which belongs to the cache kmalloc-8k of size 8192 allocated 8192-byte region

Falsifying the second login PDU instead reaches the other reader, on the same buffer:

BUG: KASAN: slab-out-of-bounds in kmemdupnul+0x43/0x80 Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50 Workqueue: isertloginwq iscsitargetdologinrx asanmemcpy+0x23/0x60 kmemdupnul+0x43/0x80 iscsidecodetextinput+0xc6/0x11c0 iscsitargetdologin+0x261/0x1470 iscsitargetdologinrx+0x51d/0x7d0

iscsit over TCP is not exposed: iscsitgetloginrx() validates the declared length with iscsitargetcheckloginrequest() and then reads exactly that many bytes off the socket, so the declared length governs how much arrives rather than how much is copied out of an already-filled buffer. isert does not call iscsitargetcheckloginrequest() at all.

Reject a login PDU whose declared DataSegmentLength exceeds what was received, in both paths that reach isertrxloginreq(): isertgetloginrx() for the first login PDU and isertloginrecvdone() for the ones after it. dlength <= loginreqlen is allowed because the received count can include up to three bytes of iSCSI padding.

Once the check is in place the copy out can no longer exceed the copy in: the posted login SGE is ISERRXPAYLOADSIZE, so loginreqlen cannot exceed MAXKEYVALUEPAIRS and the min() in isertrxloginreq() is loginreqlen.

Like the existing short-PDU check added by 29e7b925ae6d, the reject in isertloginrecvdone() returns without completing loginreqcomp, so a malformed subsequent PDU leaves the login to be torn down by the login timer rather than failing immediately. The first-PDU path returns an error and fails straight away.

Reproduced on 7.2.0-rc4 with soft-RoCE (rdmarxe) under KASAN, using an initiator that sends the real key=value payload while declaring 8193 in the BHS, on the first login PDU and on the second in separate runs. The reported read size tracks the declared value exactly; 16384 and 61440 behave the same. Unpatched 3 of 3 runs report on each of the two paths, patched 0 of 3 on both, run alternately in a single session, and a normal login still completes on the patched build.