target: check for XCOPY parameter truncation
Check for XCOPY header, CSCD descriptor and segment descriptor list truncation, and respond accordingly. SPC4r37 6.4.1 EXTENDED COPY(LID4) states (also applying to LID1 reqs): If the parameter list length causes truncation of the parameter list, then the copy manager shall transfer no data and shall terminate the EXTENDED COPY command with CHECK CONDITION status, with the sense key set to ILLEGAL REQUEST, and the additional sense code set to PARAMETER LIST LENGTH ERROR. This behaviour can be tested using the libiscsi ExtendedCopy.ParamHdr test. Signed-off-by: David Disseldorp <ddiss@suse.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
This commit is contained in:
parent
66640d35c1
commit
f94fd098f6
|
@ -888,6 +888,12 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
|
||||||
return TCM_UNSUPPORTED_SCSI_OPCODE;
|
return TCM_UNSUPPORTED_SCSI_OPCODE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (se_cmd->data_length < XCOPY_HDR_LEN) {
|
||||||
|
pr_err("XCOPY parameter truncation: length %u < hdr_len %u\n",
|
||||||
|
se_cmd->data_length, XCOPY_HDR_LEN);
|
||||||
|
return TCM_PARAMETER_LIST_LENGTH_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
|
xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
|
||||||
if (!xop) {
|
if (!xop) {
|
||||||
pr_err("Unable to allocate xcopy_op\n");
|
pr_err("Unable to allocate xcopy_op\n");
|
||||||
|
@ -923,6 +929,14 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (se_cmd->data_length < (XCOPY_HDR_LEN + tdll + sdll + inline_dl)) {
|
||||||
|
pr_err("XCOPY parameter truncation: data length %u too small "
|
||||||
|
"for tdll: %hu sdll: %u inline_dl: %u\n",
|
||||||
|
se_cmd->data_length, tdll, sdll, inline_dl);
|
||||||
|
ret = TCM_PARAMETER_LIST_LENGTH_ERROR;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
pr_debug("Processing XCOPY with list_id: 0x%02x list_id_usage: 0x%02x"
|
pr_debug("Processing XCOPY with list_id: 0x%02x list_id_usage: 0x%02x"
|
||||||
" tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
|
" tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
|
||||||
tdll, sdll, inline_dl);
|
tdll, sdll, inline_dl);
|
||||||
|
|
|
@ -1,5 +1,6 @@
|
||||||
#include <target/target_core_base.h>
|
#include <target/target_core_base.h>
|
||||||
|
|
||||||
|
#define XCOPY_HDR_LEN 16
|
||||||
#define XCOPY_TARGET_DESC_LEN 32
|
#define XCOPY_TARGET_DESC_LEN 32
|
||||||
#define XCOPY_SEGMENT_DESC_LEN 28
|
#define XCOPY_SEGMENT_DESC_LEN 28
|
||||||
#define XCOPY_NAA_IEEE_REGEX_LEN 16
|
#define XCOPY_NAA_IEEE_REGEX_LEN 16
|
||||||
|
|
Loading…
Reference in New Issue