Commit:     03766a1d4e4520066d3ed2097bfdf6e606aba828
Parent:     a8ac6311cc21d78fa284cd43f56df2063f536bf1
Author:     Olaf Kirch <[EMAIL PROTECTED]>
AuthorDate: Thu Dec 13 12:43:36 2007 -0600
Committer:  James Bottomley <[EMAIL PROTECTED]>
CommitDate: Fri Jan 11 18:28:43 2008 -0600

    [SCSI] iscsi_tcp: stop leaking r2t_info's when the incoming R2T is bad
    iscsi_r2t_rsp checks the incoming R2T for sanity, and if it
    thinks it's fishy, it will drop it silently. In this case, we
    leaked an r2t_info object. If we do this often enough, we run
    into a BUG_ON some time later.
    Removed r2t wrappers and update patch by Mike Christie
    Signed-off-by: Olaf Kirch <[EMAIL PROTECTED]>
    Signed-off-by: Mike Christie <[EMAIL PROTECTED]>
    Signed-off-by: James Bottomley <[EMAIL PROTECTED]>
 drivers/scsi/iscsi_tcp.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 7212fe9..ecba606 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -658,6 +658,8 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct 
iscsi_cmd_task *ctask)
        r2t->data_length = be32_to_cpu(rhdr->data_length);
        if (r2t->data_length == 0) {
                printk(KERN_ERR "iscsi_tcp: invalid R2T with zero data len\n");
+               __kfifo_put(tcp_ctask->r2tpool.queue, (void*)&r2t,
+                           sizeof(void*));
                return ISCSI_ERR_DATALEN;
@@ -669,10 +671,12 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct 
iscsi_cmd_task *ctask)
        r2t->data_offset = be32_to_cpu(rhdr->data_offset);
        if (r2t->data_offset + r2t->data_length > scsi_bufflen(ctask->sc)) {
-               spin_unlock(&session->lock);
                printk(KERN_ERR "iscsi_tcp: invalid R2T with data len %u at "
                       "offset %u and total length %d\n", r2t->data_length,
                       r2t->data_offset, scsi_bufflen(ctask->sc));
+               __kfifo_put(tcp_ctask->r2tpool.queue, (void*)&r2t,
+                           sizeof(void*));
+               spin_unlock(&session->lock);
                return ISCSI_ERR_DATALEN;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to