Commit cdc937a5 authored Feb 13, 2015 by Nicholas Bellinger Committed by Sasha Levin Mar 14, 2015

target: Check for LBA + sectors wrap-around in sbc_parse_cdb

commit aa179935edea9a64dec4b757090c8106a3907ffa upstream.

This patch adds a check to sbc_parse_cdb() in order to detect when
an LBA + sector vs. end-of-device calculation wraps when the LBA is
sufficently large enough (eg: 0xFFFFFFFFFFFFFFFF).

Cc: Martin Petersen <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

parent f38a130b

drivers/target/target_core_sbc.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -967,7 +967,8 @@ sbc_parse_cdb(struct se_cmd cmd, struct sbc_ops ops)
		unsigned long long end_lba;
		check_lba:
		end_lba = dev->transport->get_blocks(dev) + 1;
		if (cmd->t_task_lba + sectors > end_lba) {
		if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) \|\|
		((cmd->t_task_lba + sectors) > end_lba)) {
		pr_err("cmd exceeds last lba %llu "
		"(lba %llu, sectors %u)\n",
		end_lba, cmd->t_task_lba, sectors);