diff options
| author | Roland Dreier <roland@purestorage.com> | 2012-07-16 15:34:25 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-08-15 07:53:02 -0700 |
| commit | 120d8b93b0eb7d868c612db14ca7f47d032dfc6f (patch) | |
| tree | 06c21dd34711375956601e2f22af8ab10e35ec77 /drivers/target | |
| parent | 69722bcb5130778d70e34a2706cd041cecd98b1b (diff) | |
target: Check number of unmap descriptors against our limit
commit 7409a6657aebf8be74c21d0eded80709b27275cb upstream.
Fail UNMAP commands that have more than our reported limit on unmap
descriptors.
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/target')
| -rw-r--r-- | drivers/target/target_core_cdb.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c index d7f3d1263454..bf7d38a76e0e 100644 --- a/drivers/target/target_core_cdb.c +++ b/drivers/target/target_core_cdb.c @@ -1032,6 +1032,11 @@ int target_emulate_unmap(struct se_cmd *cmd) bd_dl = get_unaligned_be16(&buf[2]); size = min(size - 8, bd_dl); + if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) { + cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST; + ret = -EINVAL; + goto err; + } /* First UNMAP block descriptor starts at 8 byte offset */ ptr = &buf[8]; |