From mboxrd@z Thu Jan 1 00:00:00 1970 From: Johannes Thumshirn Subject: Re: [PATCH v3 02/16] scsi: don't use fc_bsg_job::request and fc_bsg_job::reply directly Date: Fri, 14 Oct 2016 09:38:21 +0200 Message-ID: <20161014073821.qvkpjtwraqnwzzs3@linux-x5ow.site> References: Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: fcoe-devel-bounces-s9riP+hp16TNLxjTenLetw@public.gmane.org Sender: "fcoe-devel" To: Steffen Maier Cc: "open list:S390 ZFCP DRIVER" , Dick Kennedy , "James E.J. Bottomley" , "Martin K . Petersen" , Linux SCSI Mailinglist , Michael Ellerman , Anil Gurumurthy , "supporter:QLOGIC QLA2XXX FC-SCSI DRIVER" , Sudarsana Kalluru , Heiko Carstens , Linux Kernel Mailinglist , "open list:FCOE SUBSYSTEM (libfc, libfcoe, fcoe)" , Christoph Hellwig , James Smart , Paul Mackerras , Benjamin Herrenschmidt , Martin Schwidefsky , Johannes Thumshirn List-Id: linux-scsi@vger.kernel.org On Thu, Oct 13, 2016 at 05:55:11PM +0200, Steffen Maier wrote: > Hm, still behaves for me like I reported for v2: > http://marc.info/?l=3Dlinux-scsi&m=3D147637177902937&w=3D2 Hi Steffen, Can you please try the following on top of 2/16? diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport= _fc.c index 4149dac..baebaab 100644 --- a/drivers/scsi/scsi_transport_fc.c +++ b/drivers/scsi/scsi_transport_fc.c @@ -3786,6 +3786,12 @@ enum fc_dispatch_result { int cmdlen =3D sizeof(uint32_t); /* start with length of msgcode */ int ret; = + /* check if we really have all the request data needed */ + if (job->request_len < cmdlen) { + ret =3D -ENOMSG; + goto fail_host_msg; + } + /* Validate the host command */ switch (bsg_request->msgcode) { case FC_BSG_HST_ADD_RPORT: @@ -3831,12 +3837,6 @@ enum fc_dispatch_result { goto fail_host_msg; } = - /* check if we really have all the request data needed */ - if (job->request_len < cmdlen) { - ret =3D -ENOMSG; - goto fail_host_msg; - } - ret =3D i->f->bsg_request(job); if (!ret) return FC_DISPATCH_UNLOCKED; @@ -3887,6 +3887,12 @@ enum fc_dispatch_result { int cmdlen =3D sizeof(uint32_t); /* start with length of msgcode */ int ret; = + /* check if we really have all the request data needed */ + if (job->request_len < cmdlen) { + ret =3D -ENOMSG; + goto fail_rport_msg; + } + /* Validate the rport command */ switch (bsg_request->msgcode) { case FC_BSG_RPT_ELS: The rational behind this is, in fc_req_to_bsgjob() we're assigning job->request as req->cmd and job->request_len =3D req->cmd_len. But without checkinf job->request_len we don't know whether we're save to touch job->request (a.k.a. bsg_request). In the meanwhile I try to reproduce your report here. Thanks, Johannes -- = Johannes Thumshirn Storage jthumshirn-l3A5Bk7waGM@public.gmane.org +49 911 74053 689 SUSE LINUX GmbH, Maxfeldstr. 5, 90409 N=FCrnberg GF: Felix Imend=F6rffer, Jane Smithard, Graham Norton HRB 21284 (AG N=FCrnberg) Key fingerprint =3D EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850