diff options
| author |   Bart Van Assche <bvanassche@acm.org> | 2019-04-02 12:58:13 -0700 |
|---|---|---|
| committer |   Martin K. Petersen <martin.petersen@oracle.com> | 2019-04-12 20:20:06 -0400 |
| commit | 0ca650c13ba2f53cd3592d1a1d054adcd4164ca4 (patch) | |
| tree | 9b7c794ded0a814cfe933c3aca000ea1d7de0751 /drivers/target/iscsi/iscsi_target_util.c | |
| parent | scsi: target/iscsi: Only send R2T if needed (diff) | |
| download | linux-dev-0ca650c13ba2f53cd3592d1a1d054adcd4164ca4.tar.xz linux-dev-0ca650c13ba2f53cd3592d1a1d054adcd4164ca4.zip | |
scsi: target/iscsi: Handle too large immediate data buffers correctly
Since target_alloc_sgl() and iscsit_allocate_iovecs() allocate buffer space
for se_cmd.data_length bytes and since that number can be smaller than the
iSCSI Expected Data Transfer Length (EDTL), ensure that the iSCSI target
driver does not attempt to receive more bytes than what fits in the receive
buffer. Always receive the full immediate data buffer such that the iSCSI
target driver does not attempt to parse immediate data as an iSCSI PDU.
Note: the current code base only calls iscsit_get_dataout() if the size of
the immediate data buffer does not exceed the buffer size derived from the
SCSI CDB. See also target_cmd_size_check().
Cc: Mike Christie <mchristi@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Diffstat (limited to 'drivers/target/iscsi/iscsi_target_util.c')
| -rw-r--r-- | drivers/target/iscsi/iscsi_target_util.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c index 5b26bc23016a..fae85bfd790e 100644 --- a/drivers/target/iscsi/iscsi_target_util.c +++ b/drivers/target/iscsi/iscsi_target_util.c @@ -737,6 +737,7 @@ void iscsit_release_cmd(struct iscsi_cmd *cmd) kfree(cmd->pdu_list); kfree(cmd->seq_list); kfree(cmd->tmr_req); + kfree(cmd->overflow_buf); kfree(cmd->iov_data); kfree(cmd->text_in_ptr); |