diff options
author | Imran Haider <imran1008@gmail.com> | 2016-05-08 15:17:54 (GMT) |
---|---|---|
committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2016-05-10 08:20:03 (GMT) |
commit | 2b16509c5f26d6c160bd89164cf18f18d713daf6 (patch) | |
tree | 8be900fa169301d0f7e58ccc81379cea6ffa7dec | |
parent | cb7911694771faf16930b72a104d3cd41d500e2c (diff) | |
download | linux-2b16509c5f26d6c160bd89164cf18f18d713daf6.tar.xz |
iscsi-target: graceful disconnect on invalid mapping to iovec
Ensures the first page entry is within bounds. A failed check would
terminate the iSCSI connection instead of causing a NULL-dereference.
This violation seems to happen with certain iSCSI commands where the
computed CDB length is zero but the expected transfer length is
non-zero. The real problem is probably on the iSCSI initiator side
since there is a discrepancy between the iSCSI header and the
encapsulated CDB Opcode.
Signed-off-by: Imran Haider <imran1008@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
-rw-r--r-- | drivers/target/iscsi/iscsi_target.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 9a4f895..bc743d2 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -904,7 +904,14 @@ static int iscsit_map_iovec( /* * We know each entry in t_data_sg contains a page. */ - sg = &cmd->se_cmd.t_data_sg[data_offset / PAGE_SIZE]; + u32 ent = data_offset / PAGE_SIZE; + + if (ent >= cmd->se_cmd.t_data_nents) { + pr_err("Initial page entry out-of-bounds\n"); + return -1; + } + + sg = &cmd->se_cmd.t_data_sg[ent]; page_off = (data_offset % PAGE_SIZE); cmd->first_data_sg = sg; |