This is a note to let you know that I've just added the patch titled target: Add range checking to UNMAP emulation
to the 3.5-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: target-add-range-checking-to-unmap-emulation.patch and it can be found in the queue-3.5 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@vger.kernel.org> know about it. From: Roland Dreier <rol...@purestorage.com> Date: Mon, 16 Jul 2012 15:34:22 -0700 Subject: target: Add range checking to UNMAP emulation From: Roland Dreier <rol...@purestorage.com> commit 2594e29865c291db162313187612cd9f14538f33 upstream. When processing an UNMAP command, we need to make sure that the number of blocks we're asked to UNMAP does not exceed our reported maximum number of blocks per UNMAP, and that the range of blocks we're unmapping doesn't go past the end of the device. Signed-off-by: Roland Dreier <rol...@purestorage.com> Signed-off-by: Nicholas Bellinger <n...@linux-iscsi.org> [bwh: Backported to 3.2: adjust filename, context] Signed-off-by: Ben Hutchings <b...@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org> --- drivers/target/target_core_cdb.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/target/target_core_cdb.c +++ b/drivers/target/target_core_cdb.c @@ -1044,6 +1044,18 @@ int target_emulate_unmap(struct se_cmd * pr_debug("UNMAP: Using lba: %llu and range: %u\n", (unsigned long long)lba, range); + if (range > dev->se_sub_dev->se_dev_attrib.max_unmap_lba_count) { + cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST; + ret = -EINVAL; + goto err; + } + + if (lba + range > dev->transport->get_blocks(dev) + 1) { + cmd->scsi_sense_reason = TCM_ADDRESS_OUT_OF_RANGE; + ret = -EINVAL; + goto err; + } + ret = dev->transport->do_discard(dev, lba, range); if (ret < 0) { pr_err("blkdev_issue_discard() failed: %d\n", Patches currently in stable-queue which might be from rol...@purestorage.com are queue-3.5/target-check-number-of-unmap-descriptors-against-our-limit.patch queue-3.5/target-fix-possible-integer-underflow-in-unmap-emulation.patch queue-3.5/target-add-range-checking-to-unmap-emulation.patch queue-3.5/target-fix-reading-of-data-length-fields-for-unmap-commands.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html