iscsi-target: graceful disconnect on invalid mapping to iovec

Ensures the first page entry is within bounds. A failed check would
terminate the iSCSI connection instead of causing a NULL-dereference.

This violation seems to happen with certain iSCSI commands where the
computed CDB length is zero but the expected transfer length is
non-zero. The real problem is probably on the iSCSI initiator side
since there is a discrepancy between the iSCSI header and the
encapsulated CDB Opcode.

Signed-off-by: Imran Haider <imran1008@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 9a4f8957725b7d4ed216ae27be2e2472a40bad36..bc743d2a71a2590d14a72d861e7d31bf031c9a89 100644 (file)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -904,7 +904,14 @@ static int iscsit_map_iovec(
        /*
         * We know each entry in t_data_sg contains a page.
         */
-       sg = &cmd->se_cmd.t_data_sg[data_offset / PAGE_SIZE];
+       u32 ent = data_offset / PAGE_SIZE;
+
+       if (ent >= cmd->se_cmd.t_data_nents) {
+               pr_err("Initial page entry out-of-bounds\n");
+               return -1;
+       }
+
+       sg = &cmd->se_cmd.t_data_sg[ent];
        page_off = (data_offset % PAGE_SIZE);
 
        cmd->first_data_sg = sg;