tpm_tis: fix potential buffer overruns caused by bit glitches on the bus

[pandora-kernel.git] / drivers / target / target_core_device.c

diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 9b86394..c3cf95e 100644 (file)
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -646,6 +646,7 @@ void core_dev_unexport(
        spin_unlock(&dev->se_port_lock);
 
        se_dev_stop(dev);
+       lun->lun_sep = NULL;
        lun->lun_se_dev = NULL;
 }
 
@@ -658,18 +659,17 @@ int target_report_luns(struct se_task *se_task)
        unsigned char *buf;
        u32 cdb_offset = 0, lun_count = 0, offset = 8, i;
 
-       buf = transport_kmap_first_data_page(se_cmd);
+       buf = transport_kmap_data_sg(se_cmd);
+       if (!buf)
+               return -ENOMEM;
 
        /*
         * If no struct se_session pointer is present, this struct se_cmd is
         * coming via a target_core_mod PASSTHROUGH op, and not through
         * a $FABRIC_MOD.  In that case, report LUN=0 only.
         */
-       if (!se_sess) {
-               int_to_scsilun(0, (struct scsi_lun *)&buf[offset]);
-               lun_count = 1;
+       if (!se_sess)
                goto done;
-       }
 
        spin_lock_irq(&se_sess->se_node_acl->device_list_lock);
        for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
@@ -696,12 +696,20 @@ int target_report_luns(struct se_task *se_task)
         * See SPC3 r07, page 159.
         */
 done:
-       transport_kunmap_first_data_page(se_cmd);
+       /*
+        * If no LUNs are accessible, report virtual LUN 0.
+        */
+       if (lun_count == 0) {
+               int_to_scsilun(0, (struct scsi_lun *)&buf[offset]);
+               lun_count = 1;
+       }
+
        lun_count *= 8;
        buf[0] = ((lun_count >> 24) & 0xff);
        buf[1] = ((lun_count >> 16) & 0xff);
        buf[2] = ((lun_count >> 8) & 0xff);
        buf[3] = (lun_count & 0xff);
+       transport_kunmap_data_sg(se_cmd);
 
        se_task->task_scsi_status = GOOD;
        transport_complete_task(se_task, 1);
@@ -833,20 +841,20 @@ int se_dev_check_shutdown(struct se_device *dev)
 
 u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
 {
-       u32 tmp, aligned_max_sectors;
+       u32 aligned_max_sectors;
+       u32 alignment;
        /*
         * Limit max_sectors to a PAGE_SIZE aligned value for modern
         * transport_allocate_data_tasks() operation.
         */
-       tmp = rounddown((max_sectors * block_size), PAGE_SIZE);
-       aligned_max_sectors = (tmp / block_size);
-       if (max_sectors != aligned_max_sectors) {
-               printk(KERN_INFO "Rounding down aligned max_sectors from %u"
-                               " to %u\n", max_sectors, aligned_max_sectors);
-               return aligned_max_sectors;
-       }
+       alignment = max(1ul, PAGE_SIZE / block_size);
+       aligned_max_sectors = rounddown(max_sectors, alignment);
 
-       return max_sectors;
+       if (max_sectors != aligned_max_sectors)
+               pr_info("Rounding down aligned max_sectors from %u to %u\n",
+                       max_sectors, aligned_max_sectors);
+
+       return aligned_max_sectors;
 }
 
 void se_dev_set_default_attribs(
@@ -1437,24 +1445,18 @@ static struct se_lun *core_dev_get_lun(struct se_portal_group *tpg, u32 unpacked
 
 struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
        struct se_portal_group *tpg,
+       struct se_node_acl *nacl,
        u32 mapped_lun,
-       char *initiatorname,
        int *ret)
 {
        struct se_lun_acl *lacl;
-       struct se_node_acl *nacl;
 
-       if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) {
+       if (strlen(nacl->initiatorname) >= TRANSPORT_IQN_LEN) {
                pr_err("%s InitiatorName exceeds maximum size.\n",
                        tpg->se_tpg_tfo->get_fabric_name());
                *ret = -EOVERFLOW;
                return NULL;
        }
-       nacl = core_tpg_get_initiator_node_acl(tpg, initiatorname);
-       if (!nacl) {
-               *ret = -EINVAL;
-               return NULL;
-       }
        lacl = kzalloc(sizeof(struct se_lun_acl), GFP_KERNEL);
        if (!lacl) {
                pr_err("Unable to allocate memory for struct se_lun_acl.\n");
@@ -1465,7 +1467,8 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
        INIT_LIST_HEAD(&lacl->lacl_list);
        lacl->mapped_lun = mapped_lun;
        lacl->se_lun_nacl = nacl;
-       snprintf(lacl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname);
+       snprintf(lacl->initiatorname, TRANSPORT_IQN_LEN, "%s",
+                nacl->initiatorname);
 
        return lacl;
 }