From be9a19e280986947249cde912481e208ac64a662 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 7 Sep 2012 17:30:34 +0200
Subject: [PATCH] --- yaml --- r: 322917 b: refs/heads/master c:
 9b16b9edb4fd0dc86ee0fbe1f7ede580e26e85f4 h: refs/heads/master i:   322915:
 d94e34c299bc972f8e1be4b82a04dce6ebe26c32 v: v3

---
 [refs]                                    | 2 +-
 trunk/drivers/target/target_core_device.c | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 2811f2604183..40977dc0f9fa 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0d7f1299ca5540b9a63ab6e8bf0e89ea963eb6af
+refs/heads/master: 9b16b9edb4fd0dc86ee0fbe1f7ede580e26e85f4
diff --git a/trunk/drivers/target/target_core_device.c b/trunk/drivers/target/target_core_device.c
index cf2c66f3c116..9fc9a6006ca0 100644
--- a/trunk/drivers/target/target_core_device.c
+++ b/trunk/drivers/target/target_core_device.c
@@ -669,6 +669,13 @@ int target_report_luns(struct se_cmd *se_cmd)
 	unsigned char *buf;
 	u32 lun_count = 0, offset = 8, i;
 
+	if (se_cmd->data_length < 16) {
+		pr_warn("REPORT LUNS allocation length %u too small\n",
+			se_cmd->data_length);
+		se_cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+		return -EINVAL;
+	}
+
 	buf = transport_kmap_data_sg(se_cmd);
 	if (!buf)
 		return -ENOMEM;