From: Roland Dreier <roland@xxxxxxxxxxxxxxx>
Fail UNMAP commands that have more than our reported limit on unmap
descriptors.
Signed-off-by: Roland Dreier <roland@xxxxxxxxxxxxxxx>
---
drivers/target/target_core_iblock.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 2efd70c..76db75e 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -336,6 +336,11 @@ static int iblock_execute_unmap(struct se_cmd *cmd)
bd_dl = get_unaligned_be16(&buf[2]);
size = min(size - 8, bd_dl);
+ if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
+ cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+ ret = -EINVAL;
+ goto err;
+ }
/* First UNMAP block descriptor starts at 8 byte offset */
ptr = &buf[8];
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
