target: Check number of unmap descriptors against our limit

Fail UNMAP commands that have more than our reported limit on unmap
descriptors.

Signed-off-by: Roland Dreier <roland@purestorage.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 2efd70ca0b1defe4f2f07c41abd65ab3637780e3..76db75e836ede701c2aed6090a212fdf1a08ad10 100644 (file)
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -336,6 +336,11 @@ static int iblock_execute_unmap(struct se_cmd *cmd)
        bd_dl = get_unaligned_be16(&buf[2]);
 
        size = min(size - 8, bd_dl);
+       if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
+               cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+               ret = -EINVAL;
+               goto err;
+       }
 
        /* First UNMAP block descriptor starts at 8 byte offset */
        ptr = &buf[8];