Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8144955 authored by Fubo Chen's avatar Fubo Chen Committed by Nicholas Bellinger
Browse files

target: Check LUN numbers in transport_get_lun_for_[cmd,tmr] 



This patch checks the passed 'unpacked_lun' against TRANSPORT_MAX_LUNS_PER_TPG
before reading from struct se_node_acl->device_list[].

Signed-off-by: default avatarFubo Chen <fubo.chen@gmail.com>
Signed-off-by: default avatarNicholas A. Bellinger <nab@linux-iscsi.org>
parent 02f8c6ae

drivers/target/target_core_device.c

+12 −0
Original line number Diff line number Diff line
@@ -65,6 +65,12 @@ int transport_get_lun_for_cmd( 
	unsigned long flags;

	int read_only = 0;



	if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {

		se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;

		se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;

		return -1;

	}



	spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);

	deve = se_cmd->se_deve =

			&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
@@ -187,6 +193,12 @@ int transport_get_lun_for_tmr( 
	struct se_session *se_sess = SE_SESS(se_cmd);

	struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;



	if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {

		se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;

		se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;

		return -1;

	}



	spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);

	deve = se_cmd->se_deve =

			&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];