mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
[SCSI] iscsi_tcp: stop leaking r2t_info's when the incoming R2T is bad
iscsi_r2t_rsp checks the incoming R2T for sanity, and if it thinks it's fishy, it will drop it silently. In this case, we leaked an r2t_info object. If we do this often enough, we run into a BUG_ON some time later. Removed r2t wrappers and update patch by Mike Christie Signed-off-by: Olaf Kirch <olaf.kirch@oracle.com> Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
This commit is contained in:
parent
a8ac6311cc
commit
03766a1d4e
1 changed files with 5 additions and 1 deletions
|
@ -658,6 +658,8 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
|
|||
r2t->data_length = be32_to_cpu(rhdr->data_length);
|
||||
if (r2t->data_length == 0) {
|
||||
printk(KERN_ERR "iscsi_tcp: invalid R2T with zero data len\n");
|
||||
__kfifo_put(tcp_ctask->r2tpool.queue, (void*)&r2t,
|
||||
sizeof(void*));
|
||||
spin_unlock(&session->lock);
|
||||
return ISCSI_ERR_DATALEN;
|
||||
}
|
||||
|
@ -669,10 +671,12 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
|
|||
|
||||
r2t->data_offset = be32_to_cpu(rhdr->data_offset);
|
||||
if (r2t->data_offset + r2t->data_length > scsi_bufflen(ctask->sc)) {
|
||||
spin_unlock(&session->lock);
|
||||
printk(KERN_ERR "iscsi_tcp: invalid R2T with data len %u at "
|
||||
"offset %u and total length %d\n", r2t->data_length,
|
||||
r2t->data_offset, scsi_bufflen(ctask->sc));
|
||||
__kfifo_put(tcp_ctask->r2tpool.queue, (void*)&r2t,
|
||||
sizeof(void*));
|
||||
spin_unlock(&session->lock);
|
||||
return ISCSI_ERR_DATALEN;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue