Commit 2b16509c authored May 08, 2016 by Imran Haider Committed by Nicholas Bellinger May 10, 2016

iscsi-target: graceful disconnect on invalid mapping to iovec



Ensures the first page entry is within bounds. A failed check would
terminate the iSCSI connection instead of causing a NULL-dereference.

This violation seems to happen with certain iSCSI commands where the
computed CDB length is zero but the expected transfer length is
non-zero. The real problem is probably on the iSCSI initiator side
since there is a discrepancy between the iSCSI header and the
encapsulated CDB Opcode.

Signed-off-by: Imran Haider <imran1008@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

parent cb791169

drivers/target/iscsi/iscsi_target.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -904,7 +904,14 @@ static int iscsit_map_iovec(
		/*
		* We know each entry in t_data_sg contains a page.
		*/
		sg = &cmd->se_cmd.t_data_sg[data_offset / PAGE_SIZE];
		u32 ent = data_offset / PAGE_SIZE;

		if (ent >= cmd->se_cmd.t_data_nents) {
		pr_err("Initial page entry out-of-bounds\n");
		return -1;
		}

		sg = &cmd->se_cmd.t_data_sg[ent];
		page_off = (data_offset % PAGE_SIZE);

		cmd->first_data_sg = sg;