summaryrefslogtreecommitdiff
path: root/drivers/target
diff options
context:
space:
mode:
authorRoland Dreier <roland@purestorage.com>2013-02-08 15:18:40 -0800
committerNicholas Bellinger <nab@linux-iscsi.org>2013-02-13 12:16:11 -0800
commit71f41fe1fafae2e407ef19d8174207f7ff80b387 (patch)
treee780f1e3fcfec59f5ff3f876d8850843d52b442c /drivers/target
parentbb992e72f9b751fceb04afeb7736b6a3e50effcf (diff)
downloadlinux-3.10-71f41fe1fafae2e407ef19d8174207f7ff80b387.tar.gz
linux-3.10-71f41fe1fafae2e407ef19d8174207f7ff80b387.tar.bz2
linux-3.10-71f41fe1fafae2e407ef19d8174207f7ff80b387.zip
target: Fix parameter list length checking in MODE SELECT
An empty parameter list (length == 0) is not an error, so succeed MODE SELECT in this case. If the parameter list length is too small, return the correct sense code of PARAMETER LIST LENGTH ERROR. Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target')
-rw-r--r--drivers/target/target_core_spc.c13
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 803339516fb..4cb667d720a 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -1000,6 +1000,14 @@ static sense_reason_t spc_emulate_modeselect(struct se_cmd *cmd)
int ret = 0;
int i;
+ if (!cmd->data_length) {
+ target_complete_cmd(cmd, GOOD);
+ return 0;
+ }
+
+ if (cmd->data_length < off + 2)
+ return TCM_PARAMETER_LIST_LENGTH_ERROR;
+
buf = transport_kmap_data_sg(cmd);
if (!buf)
return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -1024,6 +1032,11 @@ static sense_reason_t spc_emulate_modeselect(struct se_cmd *cmd)
goto out;
check_contents:
+ if (cmd->data_length < off + length) {
+ ret = TCM_PARAMETER_LIST_LENGTH_ERROR;
+ goto out;
+ }
+
if (memcmp(buf + off, tbuf, length))
ret = TCM_INVALID_PARAMETER_LIST;