diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2012-09-07 17:30:33 +0200 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2012-09-07 20:09:08 +0200 |
| commit | 0d7f1299ca5540b9a63ab6e8bf0e89ea963eb6af (patch) | |
| tree | 25bba610d95a2d7256830eb41032e5b1e2853fd4 /drivers/target/target_core_pr.c | |
| parent | target: go through normal processing for zero-length PSCSI commands (diff) | |
| download | linux-0d7f1299ca5540b9a63ab6e8bf0e89ea963eb6af.tar.xz linux-0d7f1299ca5540b9a63ab6e8bf0e89ea963eb6af.zip | |
target: report too-small parameter lists everywhere
Several places were not checking that the parameter list length
was large enough, and thus accessing invalid memory. Zero-length
parameter lists are just a special case of this.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target/target_core_pr.c')
| -rw-r--r-- | drivers/target/target_core_pr.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 1e946502c378..956c84c6b666 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -1540,6 +1540,14 @@ static int core_scsi3_decode_spec_i_port( tidh_new->dest_local_nexus = 1; list_add_tail(&tidh_new->dest_list, &tid_dest_list); + if (cmd->data_length < 28) { + pr_warn("SPC-PR: Received PR OUT parameter list" + " length too small: %u\n", cmd->data_length); + cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST; + ret = -EINVAL; + goto out; + } + buf = transport_kmap_data_sg(cmd); /* * For a PERSISTENT RESERVE OUT specify initiator ports payload, |