summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJörn Engel <joern@logfs.org>2012-02-16 20:14:27 +0400
committerNicholas Bellinger <nab@linux-iscsi.org>2012-02-26 02:37:50 +0400
commit99f730d88fd0a25c3e2dfc357bde4cf6b8cb5b40 (patch)
tree94b74e3bbceda90501e550543dfc82f0bde13917
parent47f1b8803e1e358ebbf4f82bfdb98971c912a2c3 (diff)
downloadlinux-99f730d88fd0a25c3e2dfc357bde4cf6b8cb5b40.tar.xz
target: Fix off-by-seven in target_report_luns
cdb_offset is always equal to offset - 8, so remove that one. More importantly, the existing code only worked correct if se_cmd->data_length is a multiple of 8. Pass in a length of, say, 9 and we will happily overwrite 7 bytes of "unallocated" memory. Now, afaics this bug is currently harmless, as allocations will implicitly be padded to multiples of 8 bytes. But depending on such a fact wouldn't qualify as sound engineering practice. Signed-off-by: Joern Engel <joern@logfs.org> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
-rw-r--r--drivers/target/target_core_device.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 36fa75da085c..5cfaa4b6da42 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -650,7 +650,7 @@ int target_report_luns(struct se_task *se_task)
struct se_lun *se_lun;
struct se_session *se_sess = se_cmd->se_sess;
unsigned char *buf;
- u32 cdb_offset = 0, lun_count = 0, offset = 8, i;
+ u32 lun_count = 0, offset = 8, i;
buf = transport_kmap_data_sg(se_cmd);
if (!buf)
@@ -679,12 +679,11 @@ int target_report_luns(struct se_task *se_task)
* See SPC2-R20 7.19.
*/
lun_count++;
- if ((cdb_offset + 8) >= se_cmd->data_length)
+ if ((offset + 8) > se_cmd->data_length)
continue;
int_to_scsilun(deve->mapped_lun, (struct scsi_lun *)&buf[offset]);
offset += 8;
- cdb_offset += 8;
}
spin_unlock_irq(&se_sess->se_node_acl->device_list_lock);