diff options
| author | David Disseldorp <[email protected]> | 2016-12-23 11:37:56 +0100 |
|---|---|---|
| committer | Bart Van Assche <[email protected]> | 2017-01-10 08:41:04 -0800 |
| commit | 7d38706669ce00603b187f667a4eb67c94eac098 (patch) | |
| tree | 0c4d6bac992d92cb898e83f4e1b19fc8718de04d | |
| parent | af9f62c1686268c0517b289274d38f3a03bebd2a (diff) | |
target: bounds check XCOPY total descriptor list length
spc4r37 6.4.3.5 states:
If the combined length of the CSCD descriptors and segment descriptors
exceeds the allowed value, then the copy manager shall terminate the
command with CHECK CONDITION status, with the sense key set to ILLEGAL
REQUEST, and the additional sense code set to PARAMETER LIST LENGTH
ERROR.
This functionality can be tested using the libiscsi
ExtendedCopy.DescrLimits test.
Signed-off-by: David Disseldorp <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Signed-off-by: Bart Van Assche <[email protected]>
| -rw-r--r-- | drivers/target/target_core_xcopy.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index da0f2da732e7..0d10fcf438d1 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -894,6 +894,12 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd) */ tdll = get_unaligned_be16(&p[2]); sdll = get_unaligned_be32(&p[8]); + if (tdll + sdll > RCR_OP_MAX_DESC_LIST_LEN) { + pr_err("XCOPY descriptor list length %u exceeds maximum %u\n", + tdll + sdll, RCR_OP_MAX_DESC_LIST_LEN); + ret = TCM_PARAMETER_LIST_LENGTH_ERROR; + goto out; + } inline_dl = get_unaligned_be32(&p[12]); if (inline_dl != 0) { |