Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7409a665 authored by Roland Dreier's avatar Roland Dreier Committed by Nicholas Bellinger
Browse files

target: Check number of unmap descriptors against our limit 



Fail UNMAP commands that have more than our reported limit on unmap
descriptors.

Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent b7fc7f37

drivers/target/target_core_iblock.c

+5 −0
Original line number Diff line number Diff line
@@ -336,6 +336,11 @@ static int iblock_execute_unmap(struct se_cmd *cmd) 
	bd_dl = get_unaligned_be16(&buf[2]);



	size = min(size - 8, bd_dl);

	if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {

		cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;

		ret = -EINVAL;

		goto err;

	}



	/* First UNMAP block descriptor starts at 8 byte offset */

	ptr = &buf[8];