Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 71f41fe1 authored by Roland Dreier's avatar Roland Dreier Committed by Nicholas Bellinger
Browse files

target: Fix parameter list length checking in MODE SELECT 



An empty parameter list (length == 0) is not an error, so succeed MODE
SELECT in this case.  If the parameter list length is too small,
return the correct sense code of PARAMETER LIST LENGTH ERROR.

Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent bb992e72

drivers/target/target_core_spc.c

+13 −0
Original line number Original line Diff line number Diff line
@@ -1000,6 +1000,14 @@ static sense_reason_t spc_emulate_modeselect(struct se_cmd *cmd) 
	int ret = 0;

	int ret = 0;

	int i;

	int i;





	if (!cmd->data_length) {

		target_complete_cmd(cmd, GOOD);

		return 0;

	}



	if (cmd->data_length < off + 2)

		return TCM_PARAMETER_LIST_LENGTH_ERROR;



	buf = transport_kmap_data_sg(cmd);

	buf = transport_kmap_data_sg(cmd);

	if (!buf)

	if (!buf)

		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;

		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -1024,6 +1032,11 @@ static sense_reason_t spc_emulate_modeselect(struct se_cmd *cmd) 
	goto out;

	goto out;





check_contents:

check_contents:

	if (cmd->data_length < off + length) {

		ret = TCM_PARAMETER_LIST_LENGTH_ERROR;

		goto out;

	}



	if (memcmp(buf + off, tbuf, length))

	if (memcmp(buf + off, tbuf, length))

		ret = TCM_INVALID_PARAMETER_LIST;

		ret = TCM_INVALID_PARAMETER_LIST;