• N
    target: Fix REPORT TARGET PORT GROUPS handling with small allocation length · 6b20fa9a
    Nicholas Bellinger 提交于
    This patch fixes a bug with the handling of REPORT TARGET PORT GROUPS
    containing a smaller allocation length than the payload requires causing
    memory writes beyond the end of the buffer.  This patch checks for the
    minimum 4 byte length for the response payload length, and also checks
    upon each loop of T10_ALUA(su_dev)->tg_pt_gps_list to ensure the Target
    port group and Target port descriptor list is able to fit into the
    remaining allocation length.
    
    If the response payload exceeds the allocation length length, then rd_len
    is still increments to indicate to the initiator that the payload has
    been truncated.
    Reported-by: NRoland Dreier <roland@purestorage.com>
    Cc: stable@kernel.org
    Signed-off-by: NNicholas Bellinger <nab@risingtidesystems.com>
    6b20fa9a
target_core_alua.c 55.4 KB