Patchwork [3.5.y.z,extended,stable] Patch "target: Add missing mapped_lun bounds checking during" has been added to staging queue

mail settings
Submitter Luis Henriques
Date Feb. 28, 2013, 11:58 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/223919/
State New
Headers show


Luis Henriques - Feb. 28, 2013, 11:58 a.m.
This is a note to let you know that I have just added a patch titled

    target: Add missing mapped_lun bounds checking during

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From bda54b522312ada70ddeeb2e2817c7f7c5357dbe Mon Sep 17 00:00:00 2001
From: Nicholas Bellinger <>
Date: Mon, 18 Feb 2013 18:31:37 -0800
Subject: [PATCH] target: Add missing mapped_lun bounds checking during
 make_mappedlun setup

commit fbbf8555a986ed31e54f006b6cc637ea4ff1425b upstream.

This patch adds missing bounds checking for the configfs provided
mapped_lun value during target_fabric_make_mappedlun() setup ahead
of se_lun_acl initialization.

This addresses a potential OOPs when using a mapped_lun value that
exceeds the hardcoded TRANSPORT_MAX_LUNS_PER_TPG-1 value within

Reported-by: Jan Engelhardt <>
Cc: Jan Engelhardt <>
Signed-off-by: Nicholas Bellinger <>
Signed-off-by: Luis Henriques <>
 drivers/target/target_core_fabric_configfs.c | 8 ++++++++
 1 file changed, 8 insertions(+)



diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index 040751b..c42143b 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -350,6 +350,14 @@  static struct config_group *target_fabric_make_mappedlun(
 		ret = -EINVAL;
 		goto out;
+	if (mapped_lun > (TRANSPORT_MAX_LUNS_PER_TPG-1)) {
+		pr_err("Mapped LUN: %lu exceeds TRANSPORT_MAX_LUNS_PER_TPG"
+			"-1: %u for Target Portal Group: %u\n", mapped_lun,
+			se_tpg->se_tpg_tfo->tpg_get_tag(se_tpg));
+		ret = -EINVAL;
+		goto out;
+	}

 	lacl = core_dev_init_initiator_node_lun_acl(se_tpg, se_nacl,
 			mapped_lun, &ret);