| From | Greg Kroah-Hartman <> | Subject | [ 54/65] target: Check number of unmap descriptors against our limit | Date | Mon, 13 Aug 2012 15:14:38 -0700 |
| |
From: Greg KH <gregkh@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <roland@purestorage.com>
commit 7409a6657aebf8be74c21d0eded80709b27275cb upstream.
Fail UNMAP commands that have more than our reported limit on unmap descriptors.
Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/target/target_core_cdb.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/drivers/target/target_core_cdb.c +++ b/drivers/target/target_core_cdb.c @@ -1041,6 +1041,11 @@ int target_emulate_unmap(struct se_task bd_dl = get_unaligned_be16(&buf[2]); size = min(size - 8, bd_dl); + if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) { + cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST; + ret = -EINVAL; + goto err; + } /* First UNMAP block descriptor starts at 8 byte offset */ ptr = &buf[8];
|