This is a note to let you know that I've just added the patch titled
target: Check for LBA + sectors wrap-around in sbc_parse_cdb
to the 3.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
target-check-for-lba-sectors-wrap-around-in-sbc_parse_cdb.patch
and it can be found in the queue-3.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From aa179935edea9a64dec4b757090c8106a3907ffa Mon Sep 17 00:00:00 2001
From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
Date: Fri, 13 Feb 2015 22:27:40 +0000
Subject: target: Check for LBA + sectors wrap-around in sbc_parse_cdb
From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
commit aa179935edea9a64dec4b757090c8106a3907ffa upstream.
This patch adds a check to sbc_parse_cdb() in order to detect when
an LBA + sector vs. end-of-device calculation wraps when the LBA is
sufficently large enough (eg: 0xFFFFFFFFFFFFFFFF).
Cc: Martin Petersen <martin.petersen@xxxxxxxxxx>
Cc: Christoph Hellwig <hch@xxxxxx>
Signed-off-by: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/target/target_core_sbc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -967,7 +967,8 @@ sbc_parse_cdb(struct se_cmd *cmd, struct
unsigned long long end_lba;
check_lba:
end_lba = dev->transport->get_blocks(dev) + 1;
- if (cmd->t_task_lba + sectors > end_lba) {
+ if (((cmd->t_task_lba + sectors) < cmd->t_task_lba) ||
+ ((cmd->t_task_lba + sectors) > end_lba)) {
pr_err("cmd exceeds last lba %llu "
"(lba %llu, sectors %u)\n",
end_lba, cmd->t_task_lba, sectors);
Patches currently in stable-queue which might be from nab@xxxxxxxxxxxxxxx are
queue-3.19/target-add-missing-write_same-end-of-device-sanity-check.patch
queue-3.19/target-check-for-lba-sectors-wrap-around-in-sbc_parse_cdb.patch
queue-3.19/target-fix-r_holder-bit-usage-for-allregistrants.patch
queue-3.19/target-fix-pr_aptpl_buf_len-buffer-size-limitation.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html