target: Check LUN numbers in transport_get_lun_for_[cmd,tmr]
This patch checks the passed 'unpacked_lun' against TRANSPORT_MAX_LUNS_PER_TPG before reading from struct se_node_acl->device_list[]. Signed-off-by: Fubo Chen <fubo.chen@gmail.com> Signed-off-by: Nicholas A. Bellinger <nab@linux-iscsi.org>
This commit is contained in:
parent
02f8c6aee8
commit
d814495599
|
@ -65,6 +65,12 @@ int transport_get_lun_for_cmd(
|
||||||
unsigned long flags;
|
unsigned long flags;
|
||||||
int read_only = 0;
|
int read_only = 0;
|
||||||
|
|
||||||
|
if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {
|
||||||
|
se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;
|
||||||
|
se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
|
spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
|
||||||
deve = se_cmd->se_deve =
|
deve = se_cmd->se_deve =
|
||||||
&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
|
&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
|
||||||
|
@ -187,6 +193,12 @@ int transport_get_lun_for_tmr(
|
||||||
struct se_session *se_sess = SE_SESS(se_cmd);
|
struct se_session *se_sess = SE_SESS(se_cmd);
|
||||||
struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
|
struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
|
||||||
|
|
||||||
|
if (unpacked_lun >= TRANSPORT_MAX_LUNS_PER_TPG) {
|
||||||
|
se_cmd->scsi_sense_reason = TCM_NON_EXISTENT_LUN;
|
||||||
|
se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
|
spin_lock_irq(&SE_NODE_ACL(se_sess)->device_list_lock);
|
||||||
deve = se_cmd->se_deve =
|
deve = se_cmd->se_deve =
|
||||||
&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
|
&SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
|
||||||
|
|
Loading…
Reference in New Issue