target: Check number of unmap descriptors against our limit

Fail UNMAP commands that have more than our reported limit on unmap descriptors. Signed-off-by: Roland Dreier <[email protected]> Cc: [email protected] Signed-off-by: Nicholas Bellinger <[email protected]>
chewitt · Jul 17, 2012 · 7409a66 · 7409a66
1 parent b7fc7f3
commit 7409a66
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
@@ -336,6 +336,11 @@ static int iblock_execute_unmap(struct se_cmd *cmd)
 	bd_dl = get_unaligned_be16(&buf[2]);
 
 	size = min(size - 8, bd_dl);
+	if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
+		cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+		ret = -EINVAL;
+		goto err;
+	}
 
 	/* First UNMAP block descriptor starts at 8 byte offset */
 	ptr = &buf[8];