Re: [PATCH] iscsi: Don't access non-existent scsi_lba_status_descriptor

[John Snow]

On 1/23/20 12:05 PM, Kevin Wolf wrote:
> In iscsi_co_block_status(), we may have received num_descriptors == 0
> from the iscsi server. Therefore, we can't unconditionally access
> lbas->descriptors[0]. Add the missing check.
> 
> Signed-off-by: Kevin Wolf <address@hidden>
> ---
>  block/iscsi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/block/iscsi.c b/block/iscsi.c
> index cbd57294ab..c8feaa2f0e 100644
> --- a/block/iscsi.c
> +++ b/block/iscsi.c
> @@ -753,7 +753,7 @@ retry:
>      }
>  
>      lbas = scsi_datain_unmarshall(iTask.task);
> -    if (lbas == NULL) {
> +    if (lbas == NULL || lbas->num_descriptors == 0) {
>          ret = -EIO;
>          goto out_unlock;
>      }
> 

Naive question: Does the specification allow for such a response? Is
this inherently an error?

Anyway, this is better than accessing junk memory, so:

Reviewed-by: John Snow <address@hidden>