From bb0a76d948248854df26c8f58bed5366e020bc32 Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Tue, 18 Oct 2011 23:48:04 -0700 Subject: [PATCH] --- yaml --- r: 264695 b: refs/heads/master c: 6b20fa9aaf0c2f69ee6f9648e20ab2be0206705e h: refs/heads/master i: 264693: c0a910231481e2ee45f602b92be434444f9151cb 264691: b3e13c1d93ed251fe980e82eee33d9e5a454651e 264687: 39cb7469df504ff50c17e42866c62e277d11abea v: v3 --- [refs] | 2 +- trunk/drivers/target/target_core_alua.c | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index 92feaccb7053..087baafabe6b 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: b937d27052e5759b1308782166fe47bc76e05b4d +refs/heads/master: 6b20fa9aaf0c2f69ee6f9648e20ab2be0206705e diff --git a/trunk/drivers/target/target_core_alua.c b/trunk/drivers/target/target_core_alua.c index 007c6c298b8b..8f4447749c71 100644 --- a/trunk/drivers/target/target_core_alua.c +++ b/trunk/drivers/target/target_core_alua.c @@ -67,12 +67,32 @@ int core_emulate_report_target_port_groups(struct se_cmd *cmd) unsigned char *buf; u32 rd_len = 0, off = 4; /* Skip over RESERVED area to first Target port group descriptor */ + /* + * Need at least 4 bytes of response data or else we can't + * even fit the return data length. + */ + if (cmd->data_length < 4) { + pr_warn("REPORT TARGET PORT GROUPS allocation length %u" + " too small\n", cmd->data_length); + return -EINVAL; + } buf = transport_kmap_first_data_page(cmd); spin_lock(&su_dev->t10_alua.tg_pt_gps_lock); list_for_each_entry(tg_pt_gp, &su_dev->t10_alua.tg_pt_gps_list, tg_pt_gp_list) { + /* + * Check if the Target port group and Target port descriptor list + * based on tg_pt_gp_members count will fit into the response payload. + * Otherwise, bump rd_len to let the initiator know we have exceeded + * the allocation length and the response is truncated. + */ + if ((off + 8 + (tg_pt_gp->tg_pt_gp_members * 4)) > + cmd->data_length) { + rd_len += 8 + (tg_pt_gp->tg_pt_gp_members * 4); + continue; + } /* * PREF: Preferred target port bit, determine if this * bit should be set for port group.