summaryrefslogtreecommitdiff
path: root/drivers/target
diff options
context:
space:
mode:
authorImran Haider <imran1008@gmail.com>2016-05-08 11:17:54 -0400
committerNicholas Bellinger <nab@linux-iscsi.org>2016-05-10 01:20:03 -0700
commit2b16509c5f26d6c160bd89164cf18f18d713daf6 (patch)
tree8be900fa169301d0f7e58ccc81379cea6ffa7dec /drivers/target
parentcb7911694771faf16930b72a104d3cd41d500e2c (diff)
iscsi-target: graceful disconnect on invalid mapping to iovec
Ensures the first page entry is within bounds. A failed check would terminate the iSCSI connection instead of causing a NULL-dereference. This violation seems to happen with certain iSCSI commands where the computed CDB length is zero but the expected transfer length is non-zero. The real problem is probably on the iSCSI initiator side since there is a discrepancy between the iSCSI header and the encapsulated CDB Opcode. Signed-off-by: Imran Haider <imran1008@gmail.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target')
-rw-r--r--drivers/target/iscsi/iscsi_target.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 9a4f8957725b..bc743d2a71a2 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -904,7 +904,14 @@ static int iscsit_map_iovec(
/*
* We know each entry in t_data_sg contains a page.
*/
- sg = &cmd->se_cmd.t_data_sg[data_offset / PAGE_SIZE];
+ u32 ent = data_offset / PAGE_SIZE;
+
+ if (ent >= cmd->se_cmd.t_data_nents) {
+ pr_err("Initial page entry out-of-bounds\n");
+ return -1;
+ }
+
+ sg = &cmd->se_cmd.t_data_sg[ent];
page_off = (data_offset % PAGE_SIZE);
cmd->first_data_sg = sg;