Check LUN before reading from device_list[] array.
Signed-off-by: Fubo Chen <fubo.chen@xxxxxxxxx>
---
drivers/target/target_core_device.c | 13 +++++++++++++
1 file changed, 13 insertions(+), 0 deletions(-)
diff --git a/drivers/target/target_core_device.c
b/drivers/target/target_core_device.c
index 27d4858..ba16ad9 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -67,6 +67,13 @@ int transport_get_lun_for_cmd(
BUG_ON(!se_sess);
BUG_ON(!SE_NODE_ACL(se_sess));
+
+ if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {
+ se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;
+ se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
+ return -EINVAL;
+ }
+
spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
deve = se_cmd->se_deve =
&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
@@ -186,6 +193,12 @@ int transport_get_lun_for_tmr(
struct se_session *se_sess = SE_SESS(se_cmd);
struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
+ if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {
+ se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;
+ se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
+ return -EINVAL;
+ }
+
spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
deve = se_cmd->se_deve =
&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
--
1.7.1
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
