On 1/23/20 12:05 PM, Kevin Wolf wrote:
> In iscsi_co_block_status(), we may have received num_descriptors == 0
> from the iscsi server. Therefore, we can't unconditionally access
> lbas->descriptors[0]. Add the missing check.
>
> Signed-off-by: Kevin Wolf <kw...@redhat.com>
> ---
> block/iscsi.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/block/iscsi.c b/block/iscsi.c
> index cbd57294ab..c8feaa2f0e 100644
> --- a/block/iscsi.c
> +++ b/block/iscsi.c
> @@ -753,7 +753,7 @@ retry:
> }
>
> lbas = scsi_datain_unmarshall(iTask.task);
> - if (lbas == NULL) {
> + if (lbas == NULL || lbas->num_descriptors == 0) {
> ret = -EIO;
> goto out_unlock;
> }
>
Naive question: Does the specification allow for such a response? Is
this inherently an error?
Anyway, this is better than accessing junk memory, so:
Reviewed-by: John Snow <js...@redhat.com>
