iscsi bugfixes: handle data rsp errors

PATCH In review Mike Christie 1 participant 1 message Jul 24, 2006

Subsystems (2)

SCSI iSCSI

lore

Share & tools

lore

Mike Christie

author

2006-07-24 20:48 UTC #0 lore raw

PATCH 3/11 iscsi bugfixes: handle data rsp errors

if iscsi_data_rsp fails we must bail out. Since the pdu values like data length are invalid we cannot continue to process the data since it could over run buffers.

This fixes a bug with cisco 5428s where that target is sending too much data.

Signed-off-by Mike Christie <[email protected]>

drivers/scsi/iscsi_tcp.c +3 -1

index ab324d9..7d78459 100644
@@ -486,6 +486,8 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *co
 	case ISCSI_OP_SCSI_DATA_IN:
 		tcp_conn->in.ctask = session->cmds[itt];
 		rc = iscsi_data_rsp(conn, tcp_conn->in.ctask);
+		if (rc)
+			return rc;
 		/* fall through */
 	case ISCSI_OP_SCSI_CMD_RSP:
 		tcp_conn->in.ctask = session->cmds[itt];

@@ -532,7 +534,7 @@ copy_hdr:
 	 * skbs to complete the command then we have to copy the header
 	 * for later use
 	 */
-	if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <
+	if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <=
 	   (tcp_conn->in.datalen + tcp_conn->in.padding +
 	    (conn->datadgst_en ? 4 : 0))) {
 		debug_tcp("Copying header for later use. in.copy %d in.datalen"