summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRoland Dreier <roland@purestorage.com>2012-07-16 15:34:25 -0700
committerBen Hutchings <ben@decadent.org.uk>2012-08-02 14:37:50 +0100
commit3e51f8abdd9f7c7a70f1f77295c46a88a46766a6 (patch)
treeba8d9ee88323061882f9ac9519ba55d90bd22027
parent76191bb22af0d68261d5d9a9b6294d68133813e0 (diff)
downloadlwn-3e51f8abdd9f7c7a70f1f77295c46a88a46766a6.tar.gz
lwn-3e51f8abdd9f7c7a70f1f77295c46a88a46766a6.zip
target: Check number of unmap descriptors against our limit
commit 7409a6657aebf8be74c21d0eded80709b27275cb upstream. Fail UNMAP commands that have more than our reported limit on unmap descriptors. Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-rw-r--r--drivers/target/target_core_cdb.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
index 00f0f7dc9dcf..717a8d4a6eb9 100644
--- a/drivers/target/target_core_cdb.c
+++ b/drivers/target/target_core_cdb.c
@@ -1133,6 +1133,11 @@ int target_emulate_unmap(struct se_task *task)
bd_dl = get_unaligned_be16(&buf[2]);
size = min(size - 8, bd_dl);
+ if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
+ cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+ ret = -EINVAL;
+ goto err;
+ }
/* First UNMAP block descriptor starts at 8 byte offset */
ptr = &buf[8];