linux-kernel - [PATCH v2 3/4] target: Properly set Sense Data Length of CHECK CONDITION

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Jul 2022 19:07:12 -0700
From:   Thinh Nguyen <Thinh.Nguyen@...opsys.com>
To:     linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org,
        target-devel@...r.kernel.org,
        "Martin K. Petersen" <martin.petersen@...cle.com>
Cc:     John Youn <John.Youn@...opsys.com>,
        Felipe Balbi <balbi@...nel.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
        linux-usb@...r.kernel.org
Subject: [PATCH v2 3/4] target: Properly set Sense Data Length of CHECK CONDITION

CHECK CONDITION returns sense data, and sense data is minimum 8 bytes
long plus additional sense data length in the data buffer. Don't just
set the allocated buffer length to the cmd->scsi_sense_length and check
the sense data for that.

See SPC4-r37 section 4.5.2.1.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
---
 Changes in v2:
 - Make sure it doesn't overflow and properly pass TRANSPORT_SENSE_BUFFER to
   scsi_set_sense_information()

 drivers/target/target_core_transport.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 8c386142ef90..db53b326048d 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -3459,12 +3459,19 @@ static void translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason)
 
 	cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
 	cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
-	cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
+
 	scsi_build_sense_buffer(desc_format, buffer, key, asc, ascq);
 	if (sd->add_sense_info)
 		WARN_ON_ONCE(scsi_set_sense_information(buffer,
-							cmd->scsi_sense_length,
+							TRANSPORT_SENSE_BUFFER,
 							cmd->sense_info) < 0);
+	/*
+	 * CHECK CONDITION returns sense data, and sense data is minimum 8
+	 * bytes long plus additional Sense Data Length.
+	 * See SPC4-r37 section 4.5.2.1.
+	 */
+	cmd->scsi_sense_length = min_t(u16, buffer[7] + 8,
+				       TRANSPORT_SENSE_BUFFER);
 }
 
 int
-- 
2.28.0