target: bounds check XCOPY segment descriptor list
authorDavid Disseldorp <ddiss@suse.de>
Fri, 23 Dec 2016 10:37:55 +0000 (11:37 +0100)
committerBart Van Assche <bart.vanassche@sandisk.com>
Tue, 10 Jan 2017 16:40:58 +0000 (08:40 -0800)
commitaf9f62c1686268c0517b289274d38f3a03bebd2a
treebaa0055b782dc4914f95bd38464168f446512553
parent61c359194c46cbffec9a1f2c59c1c4011222ad84
target: bounds check XCOPY segment descriptor list

Check the length of the XCOPY request segment descriptor list against
the value advertised via the MAXIMUM SEGMENT DESCRIPTOR COUNT field in
the RECEIVE COPY OPERATING PARAMETERS response.

spc4r37 6.4.3.5 states:
  If the number of segment descriptors exceeds the allowed number, the
  copy manager shall terminate the command with CHECK CONDITION status,
  with the sense key set to ILLEGAL REQUEST, and the additional sense
  code set to TOO MANY SEGMENT DESCRIPTORS.

This functionality is testable using the libiscsi
ExtendedCopy.DescrLimits test.

Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
drivers/target/target_core_xcopy.c