On Sun, 2011-02-13 at 09:24 +0100, Fubo Chen wrote:
> Check LUN before reading from device_list[] array.
>
> Signed-off-by: Fubo Chen <fubo.chen@xxxxxxxxx>
> ---
> drivers/target/target_core_device.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+), 0 deletions(-)
>
I think this is a reasonable check to add considering the number of TCM
fabric modules calling transport_get_lun_for_[cmd,tmr]() directly.
Note this patch did not apply cleanly because of the extra BUG_ON() in
transport_get_lun_for_cmd(), but has been fixed + committed as
0f75d7cf4b259.
Thanks!
--nab
> diff --git a/drivers/target/target_core_device.c
> b/drivers/target/target_core_device.c
> index 27d4858..ba16ad9 100644
> --- a/drivers/target/target_core_device.c
> +++ b/drivers/target/target_core_device.c
> @@ -67,6 +67,13 @@ int transport_get_lun_for_cmd(
>
> BUG_ON(!se_sess);
> BUG_ON(!SE_NODE_ACL(se_sess));
> +
> + if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {
> + se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;
> + se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
> + return -EINVAL;
> + }
> +
> spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
> deve = se_cmd->se_deve =
> &SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
> @@ -186,6 +193,12 @@ int transport_get_lun_for_tmr(
> struct se_session *se_sess = SE_SESS(se_cmd);
> struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
>
> + if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {
> + se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;
> + se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
> + return -EINVAL;
> + }
> +
> spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
> deve = se_cmd->se_deve =
> &SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
