The patch below does not apply to the 3.5-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 7409a6657aebf8be74c21d0eded80709b27275cb Mon Sep 17 00:00:00 2001 From: Roland Dreier <[email protected]> Date: Mon, 16 Jul 2012 15:34:25 -0700 Subject: [PATCH] target: Check number of unmap descriptors against our limit Fail UNMAP commands that have more than our reported limit on unmap descriptors. Signed-off-by: Roland Dreier <[email protected]> Cc: [email protected] Signed-off-by: Nicholas Bellinger <[email protected]> diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c index 2efd70c..76db75e 100644 --- a/drivers/target/target_core_iblock.c +++ b/drivers/target/target_core_iblock.c @@ -336,6 +336,11 @@ static int iblock_execute_unmap(struct se_cmd *cmd) bd_dl = get_unaligned_be16(&buf[2]); size = min(size - 8, bd_dl); + if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) { + cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST; + ret = -EINVAL; + goto err; + } /* First UNMAP block descriptor starts at 8 byte offset */ ptr = &buf[8]; -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
