Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76e77daf authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 

Pull scsi target fixes from Nicholas Bellinger:
 "Here is the current set of target-pending fixes headed for v3.6-final

  The main parts of this series include bug-fixes from Paolo Bonzini to
  address an use-after-free bug in pSCSI sense exception handling, along
  with addressing some long-standing bugs wrt the handling of zero-
  length SCSI CDB payloads also specific to pSCSI pass-through device
  backends."

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  target: go through normal processing for zero-length REQUEST_SENSE
  target: support zero allocation length in REQUEST SENSE
  target: support zero-size allocation lengths in transport_kmap_data_sg
  target: fail REPORT LUNS with less than 16 bytes of payload
  target: report too-small parameter lists everywhere
  target: go through normal processing for zero-length PSCSI commands
  target: fix use-after-free with PSCSI sense data
  target: simplify code around transport_get_sense_data
  target: move transport_get_sense_data
  target: Check idr_get_new return value in iscsi_login_zero_tsih_s1
  target: Fix ->data_length re-assignment bug with SCSI overflow
parents 9bc67590 6abbdf38

drivers/target/iscsi/iscsi_target_login.c

+10 −1
Original line number Diff line number Diff line
@@ -221,6 +221,7 @@ static int iscsi_login_zero_tsih_s1( 
{

	struct iscsi_session *sess = NULL;

	struct iscsi_login_req *pdu = (struct iscsi_login_req *)buf;

	int ret;



	sess = kzalloc(sizeof(struct iscsi_session), GFP_KERNEL);

	if (!sess) {
@@ -257,9 +258,17 @@ static int iscsi_login_zero_tsih_s1( 
		return -ENOMEM;

	}

	spin_lock(&sess_idr_lock);

	idr_get_new(&sess_idr, NULL, &sess->session_index);

	ret = idr_get_new(&sess_idr, NULL, &sess->session_index);

	spin_unlock(&sess_idr_lock);



	if (ret < 0) {

		pr_err("idr_get_new() for sess_idr failed\n");

		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,

				ISCSI_LOGIN_STATUS_NO_RESOURCES);

		kfree(sess);

		return -ENOMEM;

	}



	sess->creation_time = get_jiffies_64();

	spin_lock_init(&sess->session_stats_lock);

	/*

drivers/target/target_core_alua.c

+7 −0
Original line number Diff line number Diff line
@@ -218,6 +218,13 @@ int target_emulate_set_target_port_groups(struct se_cmd *cmd) 
		cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;

		return -EINVAL;

	}

	if (cmd->data_length < 4) {

		pr_warn("SET TARGET PORT GROUPS parameter list length %u too"

			" small\n", cmd->data_length);

		cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;

		return -EINVAL;

	}



	buf = transport_kmap_data_sg(cmd);



	/*

drivers/target/target_core_device.c

+7 −0
Original line number Diff line number Diff line
@@ -669,6 +669,13 @@ int target_report_luns(struct se_cmd *se_cmd) 
	unsigned char *buf;

	u32 lun_count = 0, offset = 8, i;



	if (se_cmd->data_length < 16) {

		pr_warn("REPORT LUNS allocation length %u too small\n",

			se_cmd->data_length);

		se_cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;

		return -EINVAL;

	}



	buf = transport_kmap_data_sg(se_cmd);

	if (!buf)

		return -ENOMEM;

drivers/target/target_core_iblock.c

+15 −2
Original line number Diff line number Diff line
@@ -325,17 +325,30 @@ static int iblock_execute_unmap(struct se_cmd *cmd) 
	struct iblock_dev *ibd = dev->dev_ptr;

	unsigned char *buf, *ptr = NULL;

	sector_t lba;

	int size = cmd->data_length;

	int size;

	u32 range;

	int ret = 0;

	int dl, bd_dl;



	if (cmd->data_length < 8) {

		pr_warn("UNMAP parameter list length %u too small\n",

			cmd->data_length);

		cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;

		return -EINVAL;

	}



	buf = transport_kmap_data_sg(cmd);



	dl = get_unaligned_be16(&buf[0]);

	bd_dl = get_unaligned_be16(&buf[2]);



	size = min(size - 8, bd_dl);

	size = cmd->data_length - 8;

	if (bd_dl > size)

		pr_warn("UNMAP parameter list length %u too small, ignoring bd_dl %u\n",

			cmd->data_length, bd_dl);

	else

		size = bd_dl;



	if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {

		cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;

		ret = -EINVAL;

drivers/target/target_core_pr.c

+8 −0
Original line number Diff line number Diff line
@@ -1540,6 +1540,14 @@ static int core_scsi3_decode_spec_i_port( 
	tidh_new->dest_local_nexus = 1;

	list_add_tail(&tidh_new->dest_list, &tid_dest_list);



	if (cmd->data_length < 28) {

		pr_warn("SPC-PR: Received PR OUT parameter list"

			" length too small: %u\n", cmd->data_length);

		cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;

		ret = -EINVAL;

		goto out;

	}



	buf = transport_kmap_data_sg(cmd);

	/*

	 * For a PERSISTENT RESERVE OUT specify initiator ports payload,