Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 275fd7d1 authored by Mike Christie's avatar Mike Christie Committed by James Bottomley
Browse files

[SCSI] iscsi bugfixes: handle data rsp errors 



if iscsi_data_rsp fails we must bail out. Since the pdu values like
data length are invalid we cannot continue to process the data since
it could over run buffers.

This fixes a bug with cisco 5428s where that target is sending
too much data.

Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent b6c395ed

drivers/scsi/iscsi_tcp.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -486,6 +486,8 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn) 
	case ISCSI_OP_SCSI_DATA_IN:

	case ISCSI_OP_SCSI_DATA_IN:

		tcp_conn->in.ctask = session->cmds[itt];

		tcp_conn->in.ctask = session->cmds[itt];

		rc = iscsi_data_rsp(conn, tcp_conn->in.ctask);

		rc = iscsi_data_rsp(conn, tcp_conn->in.ctask);

		if (rc)

			return rc;

		/* fall through */

		/* fall through */

	case ISCSI_OP_SCSI_CMD_RSP:

	case ISCSI_OP_SCSI_CMD_RSP:

		tcp_conn->in.ctask = session->cmds[itt];

		tcp_conn->in.ctask = session->cmds[itt];
@@ -532,7 +534,7 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn) 
	 * skbs to complete the command then we have to copy the header

	 * skbs to complete the command then we have to copy the header

	 * for later use

	 * for later use

	 */

	 */

	if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <

	if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <=

	   (tcp_conn->in.datalen + tcp_conn->in.padding +

	   (tcp_conn->in.datalen + tcp_conn->in.padding +

	    (conn->datadgst_en ? 4 : 0))) {

	    (conn->datadgst_en ? 4 : 0))) {

		debug_tcp("Copying header for later use. in.copy %d in.datalen"

		debug_tcp("Copying header for later use. in.copy %d in.datalen"