iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iscsi-target: graceful disconnect on invalid mapping to iovec

Browse Source 
Ensures the first page entry is within bounds. A failed check would
terminate the iSCSI connection instead of causing a NULL-dereference.

This violation seems to happen with certain iSCSI commands where the
computed CDB length is zero but the expected transfer length is
non-zero. The real problem is probably on the iSCSI initiator side
since there is a discrepancy between the iSCSI header and the
encapsulated CDB Opcode.

Signed-off-by: Imran Haider <imran1008@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
This commit is contained in:
Imran Haider 2016-05-08 11:17:54 -04:00 committed by Nicholas Bellinger
parent cb79116947
commit 2b16509c5f
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/target/iscsi/iscsi_target.c
View File

@ -904,7 +904,14 @@ static int iscsit_map_iovec(
/*
* We know each entry in t_data_sg contains a page.
*/
sg = &cmd->se_cmd.t_data_sg[data_offset / PAGE_SIZE];
u32 ent = data_offset / PAGE_SIZE;
if (ent >= cmd->se_cmd.t_data_nents) {
pr_err("Initial page entry out-of-bounds\n");
return -1;
}
sg = &cmd->se_cmd.t_data_sg[ent];
page_off = (data_offset % PAGE_SIZE);
cmd->first_data_sg = sg;