From: Imran Haider Date: Sun, 8 May 2016 15:17:54 +0000 (-0400) Subject: iscsi-target: graceful disconnect on invalid mapping to iovec X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=2b16509c5f26d6c160bd89164cf18f18d713daf6;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git iscsi-target: graceful disconnect on invalid mapping to iovec Ensures the first page entry is within bounds. A failed check would terminate the iSCSI connection instead of causing a NULL-dereference. This violation seems to happen with certain iSCSI commands where the computed CDB length is zero but the expected transfer length is non-zero. The real problem is probably on the iSCSI initiator side since there is a discrepancy between the iSCSI header and the encapsulated CDB Opcode. Signed-off-by: Imran Haider Signed-off-by: Nicholas Bellinger --- diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 9a4f8957725b..bc743d2a71a2 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -904,7 +904,14 @@ static int iscsit_map_iovec( /* * We know each entry in t_data_sg contains a page. */ - sg = &cmd->se_cmd.t_data_sg[data_offset / PAGE_SIZE]; + u32 ent = data_offset / PAGE_SIZE; + + if (ent >= cmd->se_cmd.t_data_nents) { + pr_err("Initial page entry out-of-bounds\n"); + return -1; + } + + sg = &cmd->se_cmd.t_data_sg[ent]; page_off = (data_offset % PAGE_SIZE); cmd->first_data_sg = sg;