ser_gigaset: fix deallocation of platform device structure

[pandora-kernel.git] / drivers / target / target_core_cdb.c

diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
index 93b9406..903b2f5 100644 (file)
--- a/drivers/target/target_core_cdb.c
+++ b/drivers/target/target_core_cdb.c
@@ -127,11 +127,12 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
                goto out;
        }
 
-       snprintf((unsigned char *)&buf[8], 8, "LIO-ORG");
-       snprintf((unsigned char *)&buf[16], 16, "%s",
-                &dev->se_sub_dev->t10_wwn.model[0]);
-       snprintf((unsigned char *)&buf[32], 4, "%s",
-                &dev->se_sub_dev->t10_wwn.revision[0]);
+       memcpy(&buf[8], "LIO-ORG ", 8);
+       memset(&buf[16], 0x20, 16);
+       memcpy(&buf[16], dev->se_sub_dev->t10_wwn.model,
+              min_t(size_t, strlen(dev->se_sub_dev->t10_wwn.model), 16));
+       memcpy(&buf[32], dev->se_sub_dev->t10_wwn.revision,
+              min_t(size_t, strlen(dev->se_sub_dev->t10_wwn.revision), 4));
        buf[4] = 31; /* Set additional length to 31 */
 
 out:
@@ -1114,11 +1115,11 @@ int target_emulate_unmap(struct se_task *task)
        struct se_cmd *cmd = task->task_se_cmd;
        struct se_device *dev = cmd->se_dev;
        unsigned char *buf, *ptr = NULL;
-       unsigned char *cdb = &cmd->t_task_cdb[0];
        sector_t lba;
-       unsigned int size = cmd->data_length, range;
-       int ret = 0, offset;
-       unsigned short dl, bd_dl;
+       int size = cmd->data_length;
+       u32 range;
+       int ret = 0;
+       int dl, bd_dl;
 
        if (!dev->transport->do_discard) {
                pr_err("UNMAP emulation not supported for: %s\n",
@@ -1127,24 +1128,41 @@ int target_emulate_unmap(struct se_task *task)
                return -ENOSYS;
        }
 
-       /* First UNMAP block descriptor starts at 8 byte offset */
-       offset = 8;
-       size -= 8;
-       dl = get_unaligned_be16(&cdb[0]);
-       bd_dl = get_unaligned_be16(&cdb[2]);
-
        buf = transport_kmap_data_sg(cmd);
 
-       ptr = &buf[offset];
-       pr_debug("UNMAP: Sub: %s Using dl: %hu bd_dl: %hu size: %hu"
+       dl = get_unaligned_be16(&buf[0]);
+       bd_dl = get_unaligned_be16(&buf[2]);
+
+       size = min(size - 8, bd_dl);
+       if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
+               cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+               ret = -EINVAL;
+               goto err;
+       }
+
+       /* First UNMAP block descriptor starts at 8 byte offset */
+       ptr = &buf[8];
+       pr_debug("UNMAP: Sub: %s Using dl: %u bd_dl: %u size: %u"
                " ptr: %p\n", dev->transport->name, dl, bd_dl, size, ptr);
 
-       while (size) {
+       while (size >= 16) {
                lba = get_unaligned_be64(&ptr[0]);
                range = get_unaligned_be32(&ptr[8]);
                pr_debug("UNMAP: Using lba: %llu and range: %u\n",
                                 (unsigned long long)lba, range);
 
+               if (range > dev->se_sub_dev->se_dev_attrib.max_unmap_lba_count) {
+                       cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                       ret = -EINVAL;
+                       goto err;
+               }
+
+               if (lba + range > dev->transport->get_blocks(dev) + 1) {
+                       cmd->scsi_sense_reason = TCM_ADDRESS_OUT_OF_RANGE;
+                       ret = -EINVAL;
+                       goto err;
+               }
+
                ret = dev->transport->do_discard(dev, lba, range);
                if (ret < 0) {
                        pr_err("blkdev_issue_discard() failed: %d\n",