Skip to content

Commit

Permalink
target: Fix up handling of short INQUIRY buffers
Browse files Browse the repository at this point in the history 
If the initiator sends us an INQUIRY command with an allocation length
that's shorter than what we want to return, we're simply supposed to
truncate our response and return what the initiator gave us space for,
without signaling any error.  Current target code has various tests that
don't fill out the full response if the buffer is too short and
sometimes return errors incorrectly.

Fix this up by allocating a bounce buffer for INQUIRY responses if we
need to, ie if we have cmd->data_length too small as well as
SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC set in cmd->se_cmd_flags -- for most
fabrics, we always allocate at least a full page, but for tcm_loop we
may have a small buffer coming directly from the SCSI stack.

This lets us delete a lot of cmd->data_length checking, and also makes
our INQUIRY handling correct per SPC in a lot more cases.

Signed-off-by: Roland Dreier <roland@purestorage.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
  • Loading branch information
Roland Dreier authored and Nicholas Bellinger committed Feb 25, 2012
1 parent 3d28934 commit d95b824
Show file tree
Hide file tree
Showing 2 changed files with 37 additions and 115 deletions.
150 changes: 36 additions & 114 deletions drivers/target/target_core_cdb.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,24 +66,11 @@ target_fill_alua_data(struct se_port *port, unsigned char *buf)
}

static int
target_emulate_inquiry_std(struct se_cmd *cmd)
target_emulate_inquiry_std(struct se_cmd *cmd, char *buf)
{
struct se_lun *lun = cmd->se_lun;
struct se_device *dev = cmd->se_dev;
struct se_portal_group *tpg = lun->lun_sep->sep_tpg;
unsigned char *buf;

/*
* Make sure we at least have 6 bytes of INQUIRY response
* payload going back for EVPD=0
*/
if (cmd->data_length < 6) {
pr_err("SCSI Inquiry payload length: %u"
" too small for EVPD=0\n", cmd->data_length);
return -EINVAL;
}

buf = transport_kmap_data_sg(cmd);

if (dev == tpg->tpg_virt_lun0.lun_se_dev) {
buf[0] = 0x3f; /* Not connected */
Expand Down Expand Up @@ -112,29 +99,13 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
if (dev->se_sub_dev->t10_alua.alua_type == SPC3_ALUA_EMULATED)
target_fill_alua_data(lun->lun_sep, buf);

if (cmd->data_length < 8) {
buf[4] = 1; /* Set additional length to 1 */
goto out;
}

buf[7] = 0x32; /* Sync=1 and CmdQue=1 */

/*
* Do not include vendor, product, reversion info in INQUIRY
* response payload for cdbs with a small allocation length.
*/
if (cmd->data_length < 36) {
buf[4] = 3; /* Set additional length to 3 */
goto out;
}

snprintf(&buf[8], 8, "LIO-ORG");
snprintf(&buf[16], 16, "%s", dev->se_sub_dev->t10_wwn.model);
snprintf(&buf[32], 4, "%s", dev->se_sub_dev->t10_wwn.revision);
buf[4] = 31; /* Set additional length to 31 */

out:
transport_kunmap_data_sg(cmd);
return 0;
}

Expand All @@ -152,12 +123,6 @@ target_emulate_evpd_80(struct se_cmd *cmd, unsigned char *buf)
unit_serial_len = strlen(dev->se_sub_dev->t10_wwn.unit_serial);
unit_serial_len++; /* For NULL Terminator */

if (((len + 4) + unit_serial_len) > cmd->data_length) {
len += unit_serial_len;
buf[2] = ((len >> 8) & 0xff);
buf[3] = (len & 0xff);
return 0;
}
len += sprintf(&buf[4], "%s",
dev->se_sub_dev->t10_wwn.unit_serial);
len++; /* Extra Byte for NULL Terminator */
Expand Down Expand Up @@ -229,9 +194,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
if (!(dev->se_sub_dev->su_dev_flags & SDF_EMULATED_VPD_UNIT_SERIAL))
goto check_t10_vend_desc;

if (off + 20 > cmd->data_length)
goto check_t10_vend_desc;

/* CODE SET == Binary */
buf[off++] = 0x1;

Expand Down Expand Up @@ -283,12 +245,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
strlen(&dev->se_sub_dev->t10_wwn.unit_serial[0]);
unit_serial_len++; /* For NULL Terminator */

if ((len + (id_len + 4) +
(prod_len + unit_serial_len)) >
cmd->data_length) {
len += (prod_len + unit_serial_len);
goto check_port;
}
id_len += sprintf(&buf[off+12], "%s:%s", prod,
&dev->se_sub_dev->t10_wwn.unit_serial[0]);
}
Expand All @@ -306,7 +262,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
/*
* struct se_port is only set for INQUIRY VPD=1 through $FABRIC_MOD
*/
check_port:
port = lun->lun_sep;
if (port) {
struct t10_alua_lu_gp *lu_gp;
Expand All @@ -323,10 +278,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
* Get the PROTOCOL IDENTIFIER as defined by spc4r17
* section 7.5.1 Table 362
*/
if (((len + 4) + 8) > cmd->data_length) {
len += 8;
goto check_tpgi;
}
buf[off] =
(tpg->se_tpg_tfo->get_fabric_proto_ident(tpg) << 4);
buf[off++] |= 0x1; /* CODE SET == Binary */
Expand All @@ -350,15 +301,10 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
* Get the PROTOCOL IDENTIFIER as defined by spc4r17
* section 7.5.1 Table 362
*/
check_tpgi:
if (dev->se_sub_dev->t10_alua.alua_type !=
SPC3_ALUA_EMULATED)
goto check_scsi_name;

if (((len + 4) + 8) > cmd->data_length) {
len += 8;
goto check_lu_gp;
}
tg_pt_gp_mem = port->sep_alua_tg_pt_gp_mem;
if (!tg_pt_gp_mem)
goto check_lu_gp;
Expand Down Expand Up @@ -391,10 +337,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
* section 7.7.3.8
*/
check_lu_gp:
if (((len + 4) + 8) > cmd->data_length) {
len += 8;
goto check_scsi_name;
}
lu_gp_mem = dev->dev_alua_lu_gp_mem;
if (!lu_gp_mem)
goto check_scsi_name;
Expand Down Expand Up @@ -435,10 +377,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
/* Header size + Designation descriptor */
scsi_name_len += 4;

if (((len + 4) + scsi_name_len) > cmd->data_length) {
len += scsi_name_len;
goto set_len;
}
buf[off] =
(tpg->se_tpg_tfo->get_fabric_proto_ident(tpg) << 4);
buf[off++] |= 0x3; /* CODE SET == UTF-8 */
Expand Down Expand Up @@ -474,7 +412,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
/* Header size + Designation descriptor */
len += (scsi_name_len + 4);
}
set_len:
buf[2] = ((len >> 8) & 0xff);
buf[3] = (len & 0xff); /* Page Length for VPD 0x83 */
return 0;
Expand All @@ -484,9 +421,6 @@ target_emulate_evpd_83(struct se_cmd *cmd, unsigned char *buf)
static int
target_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
{
if (cmd->data_length < 60)
return 0;

buf[3] = 0x3c;
/* Set HEADSUP, ORDSUP, SIMPSUP */
buf[5] = 0x07;
Expand All @@ -512,20 +446,6 @@ target_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
if (dev->se_sub_dev->se_dev_attrib.emulate_tpu || dev->se_sub_dev->se_dev_attrib.emulate_tpws)
have_tp = 1;

if (cmd->data_length < (0x10 + 4)) {
pr_debug("Received data_length: %u"
" too small for EVPD 0xb0\n",
cmd->data_length);
return -EINVAL;
}

if (have_tp && cmd->data_length < (0x3c + 4)) {
pr_debug("Received data_length: %u"
" too small for TPE=1 EVPD 0xb0\n",
cmd->data_length);
have_tp = 0;
}

buf[0] = dev->transport->get_device_type(dev);
buf[3] = have_tp ? 0x3c : 0x10;

Expand All @@ -548,10 +468,9 @@ target_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
put_unaligned_be32(dev->se_sub_dev->se_dev_attrib.optimal_sectors, &buf[12]);

/*
* Exit now if we don't support TP or the initiator sent a too
* short buffer.
* Exit now if we don't support TP.
*/
if (!have_tp || cmd->data_length < (0x3c + 4))
if (!have_tp)
return 0;

/*
Expand Down Expand Up @@ -589,10 +508,7 @@ target_emulate_evpd_b1(struct se_cmd *cmd, unsigned char *buf)

buf[0] = dev->transport->get_device_type(dev);
buf[3] = 0x3c;

if (cmd->data_length >= 5 &&
dev->se_sub_dev->se_dev_attrib.is_nonrot)
buf[5] = 1;
buf[5] = dev->se_sub_dev->se_dev_attrib.is_nonrot ? 1 : 0;

return 0;
}
Expand Down Expand Up @@ -671,8 +587,6 @@ target_emulate_evpd_00(struct se_cmd *cmd, unsigned char *buf)
{
int p;

if (cmd->data_length < 8)
return 0;
/*
* Only report the INQUIRY EVPD=1 pages after a valid NAA
* Registered Extended LUN WWN has been set via ConfigFS
Expand All @@ -681,8 +595,7 @@ target_emulate_evpd_00(struct se_cmd *cmd, unsigned char *buf)
if (cmd->se_dev->se_sub_dev->su_dev_flags &
SDF_EMULATED_VPD_UNIT_SERIAL) {
buf[3] = ARRAY_SIZE(evpd_handlers);
for (p = 0; p < min_t(int, ARRAY_SIZE(evpd_handlers),
cmd->data_length - 4); ++p)
for (p = 0; p < ARRAY_SIZE(evpd_handlers); ++p)
buf[p + 4] = evpd_handlers[p].page;
}

Expand All @@ -693,55 +606,64 @@ int target_emulate_inquiry(struct se_task *task)
{
struct se_cmd *cmd = task->task_se_cmd;
struct se_device *dev = cmd->se_dev;
unsigned char *buf;
unsigned char *buf, *map_buf;
unsigned char *cdb = cmd->t_task_cdb;
int p, ret;

map_buf = transport_kmap_data_sg(cmd);
/*
* If SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is not set, then we
* know we actually allocated a full page. Otherwise, if the
* data buffer is too small, allocate a temporary buffer so we
* don't have to worry about overruns in all our INQUIRY
* emulation handling.
*/
if (cmd->data_length < SE_INQUIRY_BUF &&
(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC)) {
buf = kzalloc(SE_INQUIRY_BUF, GFP_KERNEL);
if (!buf) {
transport_kunmap_data_sg(cmd);
cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
return -ENOMEM;
}
} else {
buf = map_buf;
}

if (!(cdb[1] & 0x1)) {
if (cdb[2]) {
pr_err("INQUIRY with EVPD==0 but PAGE CODE=%02x\n",
cdb[2]);
cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
return -EINVAL;
ret = -EINVAL;
goto out;
}

ret = target_emulate_inquiry_std(cmd);
ret = target_emulate_inquiry_std(cmd, buf);
goto out;
}

/*
* Make sure we at least have 4 bytes of INQUIRY response
* payload for 0x00 going back for EVPD=1. Note that 0x80
* and 0x83 will check for enough payload data length and
* jump to set_len: label when there is not enough inquiry EVPD
* payload length left for the next outgoing EVPD metadata
*/
if (cmd->data_length < 4) {
pr_err("SCSI Inquiry payload length: %u"
" too small for EVPD=1\n", cmd->data_length);
cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
return -EINVAL;
}

buf = transport_kmap_data_sg(cmd);

buf[0] = dev->transport->get_device_type(dev);

for (p = 0; p < ARRAY_SIZE(evpd_handlers); ++p) {
if (cdb[2] == evpd_handlers[p].page) {
buf[1] = cdb[2];
ret = evpd_handlers[p].emulate(cmd, buf);
goto out_unmap;
goto out;
}
}

pr_err("Unknown VPD Code: 0x%02x\n", cdb[2]);
cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
ret = -EINVAL;

out_unmap:
transport_kunmap_data_sg(cmd);
out:
if (buf != map_buf) {
memcpy(map_buf, buf, cmd->data_length);
kfree(buf);
}
transport_kunmap_data_sg(cmd);

if (!ret) {
task->task_scsi_status = GOOD;
transport_complete_task(task, 1);
Expand Down
2 changes: 1 addition & 1 deletion include/target/target_core_base.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -118,9 +118,9 @@
/* Queue Algorithm Modifier default for restricted reordering in control mode page */
#define DA_EMULATE_REST_REORD 0

#define SE_INQUIRY_BUF 512
#define SE_MODE_PAGE_BUF 512


/* struct se_hba->hba_flags */
enum hba_flags_table {
HBA_FLAGS_INTERNAL_USE = 0x01,
Expand Down

0 comments on commit d95b824

Please sign in to comment.