Commit ffe7b0e9 authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Nicholas Bellinger

target: support zero allocation length in INQUIRY

INQUIRY processing already uses an on-heap bounce buffer for loopback,
but not for other fabrics.  Switch this to a cheaper on-stack bounce
buffer, similar to the one used by MODE SENSE and REQUEST SENSE, and
use it unconditionally.  With this in place, zero allocation length is
handled simply by checking the return address of transport_kmap_data_sg.

Testcase: sg_raw /dev/sdb 12 00 83 00 00 00
    should fail with ILLEGAL REQUEST / INVALID FIELD IN CDB sense
    does not fail without the patch
    fails correctly with the series
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent bf11eefc
...@@ -600,30 +600,11 @@ static int spc_emulate_inquiry(struct se_cmd *cmd) ...@@ -600,30 +600,11 @@ static int spc_emulate_inquiry(struct se_cmd *cmd)
{ {
struct se_device *dev = cmd->se_dev; struct se_device *dev = cmd->se_dev;
struct se_portal_group *tpg = cmd->se_lun->lun_sep->sep_tpg; struct se_portal_group *tpg = cmd->se_lun->lun_sep->sep_tpg;
unsigned char *buf, *map_buf; unsigned char *rbuf;
unsigned char *cdb = cmd->t_task_cdb; unsigned char *cdb = cmd->t_task_cdb;
unsigned char buf[SE_INQUIRY_BUF];
int p, ret; int p, ret;
map_buf = transport_kmap_data_sg(cmd);
/*
* If SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is not set, then we
* know we actually allocated a full page. Otherwise, if the
* data buffer is too small, allocate a temporary buffer so we
* don't have to worry about overruns in all our INQUIRY
* emulation handling.
*/
if (cmd->data_length < SE_INQUIRY_BUF &&
(cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC)) {
buf = kzalloc(SE_INQUIRY_BUF, GFP_KERNEL);
if (!buf) {
transport_kunmap_data_sg(cmd);
cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
return -ENOMEM;
}
} else {
buf = map_buf;
}
if (dev == tpg->tpg_virt_lun0.lun_se_dev) if (dev == tpg->tpg_virt_lun0.lun_se_dev)
buf[0] = 0x3f; /* Not connected */ buf[0] = 0x3f; /* Not connected */
else else
...@@ -655,11 +636,11 @@ static int spc_emulate_inquiry(struct se_cmd *cmd) ...@@ -655,11 +636,11 @@ static int spc_emulate_inquiry(struct se_cmd *cmd)
ret = -EINVAL; ret = -EINVAL;
out: out:
if (buf != map_buf) { rbuf = transport_kmap_data_sg(cmd);
memcpy(map_buf, buf, cmd->data_length); if (rbuf) {
kfree(buf); memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
transport_kunmap_data_sg(cmd);
} }
transport_kunmap_data_sg(cmd);
if (!ret) if (!ret)
target_complete_cmd(cmd, GOOD); target_complete_cmd(cmd, GOOD);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment