mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
[SCSI] iscsi bugfixes: handle data rsp errors
if iscsi_data_rsp fails we must bail out. Since the pdu values like data length are invalid we cannot continue to process the data since it could over run buffers. This fixes a bug with cisco 5428s where that target is sending too much data. Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This commit is contained in:
parent
b6c395ed03
commit
275fd7d129
1 changed files with 3 additions and 1 deletions
|
@ -486,6 +486,8 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn)
|
|||
case ISCSI_OP_SCSI_DATA_IN:
|
||||
tcp_conn->in.ctask = session->cmds[itt];
|
||||
rc = iscsi_data_rsp(conn, tcp_conn->in.ctask);
|
||||
if (rc)
|
||||
return rc;
|
||||
/* fall through */
|
||||
case ISCSI_OP_SCSI_CMD_RSP:
|
||||
tcp_conn->in.ctask = session->cmds[itt];
|
||||
|
@ -532,7 +534,7 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn)
|
|||
* skbs to complete the command then we have to copy the header
|
||||
* for later use
|
||||
*/
|
||||
if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <
|
||||
if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <=
|
||||
(tcp_conn->in.datalen + tcp_conn->in.padding +
|
||||
(conn->datadgst_en ? 4 : 0))) {
|
||||
debug_tcp("Copying header for later use. in.copy %d in.datalen"
|
||||
|
|
Loading…
Reference in a new issue