Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-10 15:58:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

target: Fix off-by-seven in target_report_luns

Browse Source 
cdb_offset is always equal to offset - 8, so remove that one.  More
importantly, the existing code only worked correct if
se_cmd->data_length is a multiple of 8.  Pass in a length of, say, 9 and
we will happily overwrite 7 bytes of "unallocated" memory.

Now, afaics this bug is currently harmless, as allocations will
implicitly be padded to multiples of 8 bytes.  But depending on such a
fact wouldn't qualify as sound engineering practice.

Signed-off-by: Joern Engel <joern@logfs.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
Jörn Engel 2012-02-16 11:14:27 -05:00 committed by Nicholas Bellinger
parent 47f1b8803e
commit 99f730d88f
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/target/target_core_device.c
View File

@ -650,7 +650,7 @@ int target_report_luns(struct se_task *se_task)
struct se_lun *se_lun; struct se_lun *se_lun;
struct se_session *se_sess = se_cmd->se_sess; struct se_session *se_sess = se_cmd->se_sess;
unsigned char *buf; unsigned char *buf;
u32 cdb_offset = 0, lun_count = 0, offset = 8, i; u32 lun_count = 0, offset = 8, i;
buf = transport_kmap_data_sg(se_cmd); buf = transport_kmap_data_sg(se_cmd);
if (!buf) if (!buf)
@ -679,12 +679,11 @@ int target_report_luns(struct se_task *se_task)
* See SPC2-R20 7.19. * See SPC2-R20 7.19.
*/ */
lun_count++; lun_count++;
if ((cdb_offset + 8) >= se_cmd->data_length) if ((offset + 8) > se_cmd->data_length)
continue; continue;
int_to_scsilun(deve->mapped_lun, (struct scsi_lun *)&buf[offset]); int_to_scsilun(deve->mapped_lun, (struct scsi_lun *)&buf[offset]);
offset += 8; offset += 8;
cdb_offset += 8;
} }
spin_unlock_irq(&se_sess->se_node_acl->device_list_lock); spin_unlock_irq(&se_sess->se_node_acl->device_list_lock);