ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-23 12:43:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

scsi: target: core: Prevent underflow for service actions

Browse Source 
TCM buffer length doesn't necessarily equal 8 + ADDITIONAL LENGTH which
might be considered an underflow in case of Data-In size being greater than
8 + ADDITIONAL LENGTH. So truncate buffer length to prevent underflow.

Link: https://lore.kernel.org/r/20210209072202.41154-3-a.miloserdov@yadro.com
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>
Signed-off-by: Aleksandr Miloserdov <a.miloserdov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Aleksandr Miloserdov
2021-02-09 10:22:02 +03:00
committed by Martin K. Petersen
parent 1c73e0c5e5
commit 14d24e2cc7
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/target/target_core_pr.c
View File

@@ -3739,6 +3739,7 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd)
spin_unlock(&dev->t10_pr.registration_lock); spin_unlock(&dev->t10_pr.registration_lock);
put_unaligned_be32(add_len, &buf[4]); put_unaligned_be32(add_len, &buf[4]);
target_set_cmd_data_length(cmd, 8 + add_len);
transport_kunmap_data_sg(cmd); transport_kunmap_data_sg(cmd);
@@ -3757,7 +3758,7 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
struct t10_pr_registration *pr_reg; struct t10_pr_registration *pr_reg;
unsigned char *buf; unsigned char *buf;
u64 pr_res_key; u64 pr_res_key;
u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */ u32 add_len = 0;
if (cmd->data_length < 8) { if (cmd->data_length < 8) {
pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u" pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u"
@@ -3775,8 +3776,9 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
pr_reg = dev->dev_pr_res_holder; pr_reg = dev->dev_pr_res_holder;
if (pr_reg) { if (pr_reg) {
/* /*
* Set the hardcoded Additional Length * Set the Additional Length to 16 when a reservation is held
*/ */
add_len = 16;
put_unaligned_be32(add_len, &buf[4]); put_unaligned_be32(add_len, &buf[4]);
if (cmd->data_length < 22) if (cmd->data_length < 22)
@@ -3812,6 +3814,8 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
(pr_reg->pr_res_type & 0x0f); (pr_reg->pr_res_type & 0x0f);
} }
target_set_cmd_data_length(cmd, 8 + add_len);
err: err:
spin_unlock(&dev->dev_reservation_lock); spin_unlock(&dev->dev_reservation_lock);
transport_kunmap_data_sg(cmd); transport_kunmap_data_sg(cmd);
@@ -3830,7 +3834,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
struct se_device *dev = cmd->se_dev; struct se_device *dev = cmd->se_dev;
struct t10_reservation *pr_tmpl = &dev->t10_pr; struct t10_reservation *pr_tmpl = &dev->t10_pr;
unsigned char *buf; unsigned char *buf;
u16 add_len = 8; /* Hardcoded to 8. */ u16 len = 8; /* Hardcoded to 8. */
if (cmd->data_length < 6) { if (cmd->data_length < 6) {
pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:" pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:"
@@ -3842,7 +3846,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
if (!buf) if (!buf)
return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
put_unaligned_be16(add_len, &buf[0]); put_unaligned_be16(len, &buf[0]);
buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */ buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */
buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */ buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */
buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */ buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */
@@ -3871,6 +3875,8 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */ buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */
buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */ buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */
target_set_cmd_data_length(cmd, len);
transport_kunmap_data_sg(cmd); transport_kunmap_data_sg(cmd);
return 0; return 0;
@@ -4031,6 +4037,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
* Set ADDITIONAL_LENGTH * Set ADDITIONAL_LENGTH
*/ */
put_unaligned_be32(add_len, &buf[4]); put_unaligned_be32(add_len, &buf[4]);
target_set_cmd_data_length(cmd, 8 + add_len);
transport_kunmap_data_sg(cmd); transport_kunmap_data_sg(cmd);