lkml.org 
[lkml]   [2018]   [Jul]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 05/53] scsi: target: Fix truncated PR-in ReadKeys response
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: David Disseldorp <ddiss@suse.de>

    commit 63ce3c384db26494615e3c8972bcd419ed71f4c4 upstream.

    SPC5r17 states that the contents of the ADDITIONAL LENGTH field are not
    altered based on the allocation length, so always calculate and pack the
    full key list length even if the list itself is truncated.

    According to Maged:

    Yes it fixes the "Storage Spaces Persistent Reservation" test in the
    Windows 2016 Server Failover Cluster validation suites when having
    many connections that result in more than 8 registrations. I tested
    your patch on 4.17 with iblock.

    This behaviour can be tested using the libiscsi PrinReadKeys.Truncate test.

    Cc: stable@vger.kernel.org
    Signed-off-by: David Disseldorp <ddiss@suse.de>
    Reviewed-by: Mike Christie <mchristi@redhat.com>
    Tested-by: Maged Mokhtar <mmokhtar@petasan.org>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/target/target_core_pr.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    --- a/drivers/target/target_core_pr.c
    +++ b/drivers/target/target_core_pr.c
    @@ -3729,11 +3729,16 @@ core_scsi3_pri_read_keys(struct se_cmd *
    * Check for overflow of 8byte PRI READ_KEYS payload and
    * next reservation key list descriptor.
    */
    - if ((add_len + 8) > (cmd->data_length - 8))
    - break;
    -
    - put_unaligned_be64(pr_reg->pr_res_key, &buf[off]);
    - off += 8;
    + if (off + 8 <= cmd->data_length) {
    + put_unaligned_be64(pr_reg->pr_res_key, &buf[off]);
    + off += 8;
    + }
    + /*
    + * SPC5r17: 6.16.2 READ KEYS service action
    + * The ADDITIONAL LENGTH field indicates the number of bytes in
    + * the Reservation key list. The contents of the ADDITIONAL
    + * LENGTH field are not altered based on the allocation length
    + */
    add_len += 8;
    }
    spin_unlock(&dev->t10_pr.registration_lock);

    \
     
     \ /
      Last update: 2018-07-10 20:45    [W:2.457 / U:0.368 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site