forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[SCSI] iscsi bugfixes: handle data rsp errors

Browse source 
if iscsi_data_rsp fails we must bail out. Since the pdu values like
data length are invalid we cannot continue to process the data since
it could over run buffers.

This fixes a bug with cisco 5428s where that target is sending
too much data.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This commit is contained in:
Mike Christie 2006-07-24 15:47:17 -05:00 • committed by James Bottomley
parent b6c395ed03
commit 275fd7d129
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/scsi/iscsi_tcp.c
View file

@ -486,6 +486,8 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn)
case ISCSI_OP_SCSI_DATA_IN: case ISCSI_OP_SCSI_DATA_IN:
tcp_conn->in.ctask = session->cmds[itt]; tcp_conn->in.ctask = session->cmds[itt];
rc = iscsi_data_rsp(conn, tcp_conn->in.ctask); rc = iscsi_data_rsp(conn, tcp_conn->in.ctask);
if (rc)
return rc;
/* fall through */ /* fall through */
case ISCSI_OP_SCSI_CMD_RSP: case ISCSI_OP_SCSI_CMD_RSP:
tcp_conn->in.ctask = session->cmds[itt]; tcp_conn->in.ctask = session->cmds[itt];
@ -532,7 +534,7 @@ copy_hdr:
* skbs to complete the command then we have to copy the header * skbs to complete the command then we have to copy the header
* for later use * for later use
*/ */
if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy < if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <=
(tcp_conn->in.datalen + tcp_conn->in.padding + (tcp_conn->in.datalen + tcp_conn->in.padding +
(conn->datadgst_en ? 4 : 0))) { (conn->datadgst_en ? 4 : 0))) {
debug_tcp("Copying header for later use. in.copy %d in.datalen" debug_tcp("Copying header for later use. in.copy %d in.datalen"