linux/drivers/target/iscsi
Nicholas Bellinger abb85a9b51 iscsi-target: Reject immediate data underflow larger than SCSI transfer length
When iscsi WRITE underflow occurs there are two different scenarios
that can happen.

Normally in practice, when an EDTL vs. SCSI CDB TRANSFER LENGTH
underflow is detected, the iscsi immediate data payload is the
smaller SCSI CDB TRANSFER LENGTH.

That is, when a host fabric LLD is using a fixed size EDTL for
a specific control CDB, the SCSI CDB TRANSFER LENGTH and actual
SCSI payload ends up being smaller than EDTL.  In iscsi, this
means the received iscsi immediate data payload matches the
smaller SCSI CDB TRANSFER LENGTH, because there is no more
SCSI payload to accept beyond SCSI CDB TRANSFER LENGTH.

However, it's possible for a malicous host to send a WRITE
underflow where EDTL is larger than SCSI CDB TRANSFER LENGTH,
but incoming iscsi immediate data actually matches EDTL.

In the wild, we've never had a iscsi host environment actually
try to do this.

For this special case, it's wrong to truncate part of the
control CDB payload and continue to process the command during
underflow when immediate data payload received was larger than
SCSI CDB TRANSFER LENGTH, so go ahead and reject and drop the
bogus payload as a defensive action.

Note this potential bug was originally relaxed by the following
for allowing WRITE underflow in MSFT FCP host environments:

   commit c72c525022
   Author: Roland Dreier <roland@purestorage.com>
   Date:   Wed Jul 22 15:08:18 2015 -0700

      target: allow underflow/overflow for PR OUT etc. commands

Cc: Roland Dreier <roland@purestorage.com>
Cc: Mike Christie <mchristi@redhat.com>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: <stable@vger.kernel.org> # v4.3+
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
2017-06-08 22:25:29 -07:00
..
cxgbit Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-03-03 10:16:38 -08:00
Kconfig cxgbit: add files for cxgbit.ko 2016-05-09 23:12:54 -07:00
Makefile cxgbit: add files for cxgbit.ko 2016-05-09 23:12:54 -07:00
iscsi_target.c iscsi-target: Reject immediate data underflow larger than SCSI transfer length 2017-06-08 22:25:29 -07:00
iscsi_target.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_auth.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_auth.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_configfs.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2017-05-12 11:44:13 -07:00
iscsi_target_datain_values.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_datain_values.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_device.c target: Fix max_cmd_sn increment w/o cmdsn mutex regressions 2015-09-11 00:32:28 -07:00
iscsi_target_device.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_erl0.c iscsi-target: Always wait for kthread_should_stop() before kthread exit 2017-05-31 15:12:57 -07:00
iscsi_target_erl0.h iscsi-target: Always wait for kthread_should_stop() before kthread exit 2017-05-31 15:12:57 -07:00
iscsi_target_erl1.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_erl1.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_erl2.c target/iscsi: Fix spelling of "reallegiance" 2017-02-09 00:39:08 -08:00
iscsi_target_erl2.h target/iscsi: Fix spelling of "reallegiance" 2017-02-09 00:39:08 -08:00
iscsi_target_login.c iscsi-target: Always wait for kthread_should_stop() before kthread exit 2017-05-31 15:12:57 -07:00
iscsi_target_login.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_nego.c iscsi-target: Fix initial login PDU asynchronous socket close OOPs 2017-05-31 15:12:31 -07:00
iscsi_target_nego.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_nodeattrib.c iscsi-target: Move iscsi_target_[core,stat].h under linux include 2015-01-30 13:06:21 -08:00
iscsi_target_nodeattrib.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_parameters.c iscsi-target: Drop work-around for legacy GlobalSAN initiator 2017-04-02 14:10:16 -07:00
iscsi_target_parameters.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_seq_pdu_list.c iscsi-target: Move iscsi_target_[core,stat].h under linux include 2015-01-30 13:06:21 -08:00
iscsi_target_seq_pdu_list.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_stat.c target: use per-attribute show and store methods 2015-10-13 22:17:49 -07:00
iscsi_target_tmr.c target/iscsi: Fix spelling of "reallegiance" 2017-02-09 00:39:08 -08:00
iscsi_target_tmr.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_tpg.c target/iscsi: Fix double free in lio_target_tiqn_addtpg() 2016-12-16 11:15:11 +01:00
iscsi_target_tpg.h target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_transport.c target: Minimize #include directives 2016-12-09 10:22:28 -08:00
iscsi_target_util.c iscsi-target: Propigate queue_data_in + queue_status errors 2017-03-30 20:34:58 -07:00
iscsi_target_util.h iscsi-target: Propigate queue_data_in + queue_status errors 2017-03-30 20:34:58 -07:00