Skip to content

Commit 50e5c87

Browse files
Christoph HellwigNicholas Bellinger
Christoph Hellwig
authored and
Nicholas Bellinger
committed
iscsit: proper endianess conversions
Make sure all on the wire types are use as big endian and big endian only so that sparse can verify all the conversions are done right. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
1 parent 66c7db6 commit 50e5c87

10 files changed

+122
-138
lines changed

‎drivers/target/iscsi/iscsi_target.c

Lines changed: 55 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -785,9 +785,6 @@ static int iscsit_handle_scsi_cmd(
785785

786786
hdr = (struct iscsi_scsi_req *) buf;
787787
payload_length = ntoh24(hdr->dlength);
788-
hdr->data_length = be32_to_cpu(hdr->data_length);
789-
hdr->cmdsn = be32_to_cpu(hdr->cmdsn);
790-
hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
791788

792789
/* FIXME; Add checks for AdditionalHeaderSegment */
793790

@@ -851,7 +848,7 @@ static int iscsit_handle_scsi_cmd(
851848
buf, conn);
852849
}
853850

854-
if ((hdr->data_length == payload_length) &&
851+
if ((be32_to_cpu(hdr->data_length )== payload_length) &&
855852
(!(hdr->flags & ISCSI_FLAG_CMD_FINAL))) {
856853
pr_err("Expected Data Transfer Length and Length of"
857854
" Immediate Data are the same, but ISCSI_FLAG_CMD_FINAL"
@@ -860,7 +857,7 @@ static int iscsit_handle_scsi_cmd(
860857
buf, conn);
861858
}
862859

863-
if (payload_length > hdr->data_length) {
860+
if (payload_length > be32_to_cpu(hdr->data_length)) {
864861
pr_err("DataSegmentLength: %u is greater than"
865862
" EDTL: %u, protocol error.\n", payload_length,
866863
hdr->data_length);
@@ -931,8 +928,8 @@ static int iscsit_handle_scsi_cmd(
931928
spin_unlock_bh(&conn->sess->ttt_lock);
932929
} else if (hdr->flags & ISCSI_FLAG_CMD_WRITE)
933930
cmd->targ_xfer_tag = 0xFFFFFFFF;
934-
cmd->cmd_sn = hdr->cmdsn;
935-
cmd->exp_stat_sn = hdr->exp_statsn;
931+
cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
932+
cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
936933
cmd->first_burst_len = payload_length;
937934

938935
if (cmd->data_direction == DMA_FROM_DEVICE) {
@@ -951,8 +948,9 @@ static int iscsit_handle_scsi_cmd(
951948
* Initialize struct se_cmd descriptor from target_core_mod infrastructure
952949
*/
953950
transport_init_se_cmd(&cmd->se_cmd, &lio_target_fabric_configfs->tf_ops,
954-
conn->sess->se_sess, hdr->data_length, cmd->data_direction,
955-
sam_task_attr, cmd->sense_buffer + 2);
951+
conn->sess->se_sess, be32_to_cpu(hdr->data_length),
952+
cmd->data_direction, sam_task_attr,
953+
cmd->sense_buffer + 2);
956954

957955
pr_debug("Got SCSI Command, ITT: 0x%08x, CmdSN: 0x%08x,"
958956
" ExpXferLen: %u, Length: %u, CID: %hu\n", hdr->itt,
@@ -1027,7 +1025,7 @@ static int iscsit_handle_scsi_cmd(
10271025
1, 0, buf, cmd);
10281026
}
10291027

1030-
iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
1028+
iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
10311029

10321030
/*
10331031
* If no Immediate Data is attached, it's OK to return now.
@@ -1193,10 +1191,6 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
11931191

11941192
hdr = (struct iscsi_data *) buf;
11951193
payload_length = ntoh24(hdr->dlength);
1196-
hdr->ttt = be32_to_cpu(hdr->ttt);
1197-
hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
1198-
hdr->datasn = be32_to_cpu(hdr->datasn);
1199-
hdr->offset = be32_to_cpu(hdr->offset);
12001194

12011195
if (!payload_length) {
12021196
pr_err("DataOUT payload is ZERO, protocol error.\n");
@@ -1248,7 +1242,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
12481242
se_cmd = &cmd->se_cmd;
12491243
iscsit_mod_dataout_timer(cmd);
12501244

1251-
if ((hdr->offset + payload_length) > cmd->se_cmd.data_length) {
1245+
if ((be32_to_cpu(hdr->offset) + payload_length) > cmd->se_cmd.data_length) {
12521246
pr_err("DataOut Offset: %u, Length %u greater than"
12531247
" iSCSI Command EDTL %u, protocol error.\n",
12541248
hdr->offset, payload_length, cmd->se_cmd.data_length);
@@ -1331,7 +1325,8 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
13311325
rx_size += payload_length;
13321326
iov = &cmd->iov_data[0];
13331327

1334-
iov_ret = iscsit_map_iovec(cmd, iov, hdr->offset, payload_length);
1328+
iov_ret = iscsit_map_iovec(cmd, iov, be32_to_cpu(hdr->offset),
1329+
payload_length);
13351330
if (iov_ret < 0)
13361331
return -1;
13371332

@@ -1362,7 +1357,8 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
13621357
u32 data_crc;
13631358

13641359
data_crc = iscsit_do_crypto_hash_sg(&conn->conn_rx_hash, cmd,
1365-
hdr->offset, payload_length, padding,
1360+
be32_to_cpu(hdr->offset),
1361+
payload_length, padding,
13661362
cmd->pad_bytes);
13671363

13681364
if (checksum != data_crc) {
@@ -1423,9 +1419,6 @@ static int iscsit_handle_nop_out(
14231419

14241420
hdr = (struct iscsi_nopout *) buf;
14251421
payload_length = ntoh24(hdr->dlength);
1426-
hdr->ttt = be32_to_cpu(hdr->ttt);
1427-
hdr->cmdsn = be32_to_cpu(hdr->cmdsn);
1428-
hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
14291422

14301423
if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
14311424
pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
@@ -1455,7 +1448,7 @@ static int iscsit_handle_nop_out(
14551448
* Either way, make sure we allocate an struct iscsi_cmd, as both
14561449
* can contain ping data.
14571450
*/
1458-
if (hdr->ttt == 0xFFFFFFFF) {
1451+
if (hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
14591452
cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
14601453
if (!cmd)
14611454
return iscsit_add_reject(
@@ -1468,12 +1461,12 @@ static int iscsit_handle_nop_out(
14681461
1 : 0);
14691462
conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt;
14701463
cmd->targ_xfer_tag = 0xFFFFFFFF;
1471-
cmd->cmd_sn = hdr->cmdsn;
1472-
cmd->exp_stat_sn = hdr->exp_statsn;
1464+
cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
1465+
cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
14731466
cmd->data_direction = DMA_NONE;
14741467
}
14751468

1476-
if (payload_length && (hdr->ttt == 0xFFFFFFFF)) {
1469+
if (payload_length && hdr->ttt == cpu_to_be32(0xFFFFFFFF)) {
14771470
rx_size = payload_length;
14781471
ping_data = kzalloc(payload_length + 1, GFP_KERNEL);
14791472
if (!ping_data) {
@@ -1566,7 +1559,7 @@ static int iscsit_handle_nop_out(
15661559
list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
15671560
spin_unlock_bh(&conn->cmd_lock);
15681561

1569-
iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
1562+
iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
15701563

15711564
if (hdr->opcode & ISCSI_OP_IMMEDIATE) {
15721565
iscsit_add_cmd_to_response_queue(cmd, conn,
@@ -1587,11 +1580,11 @@ static int iscsit_handle_nop_out(
15871580
return 0;
15881581
}
15891582

1590-
if (hdr->ttt != 0xFFFFFFFF) {
1583+
if (hdr->ttt != cpu_to_be32(0xFFFFFFFF)) {
15911584
/*
15921585
* This was a response to a unsolicited NOPIN ping.
15931586
*/
1594-
cmd = iscsit_find_cmd_from_ttt(conn, hdr->ttt);
1587+
cmd = iscsit_find_cmd_from_ttt(conn, be32_to_cpu(hdr->ttt));
15951588
if (!cmd)
15961589
return -1;
15971590

@@ -1636,10 +1629,6 @@ static int iscsit_handle_task_mgt_cmd(
16361629
u8 function;
16371630

16381631
hdr = (struct iscsi_tm *) buf;
1639-
hdr->cmdsn = be32_to_cpu(hdr->cmdsn);
1640-
hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
1641-
hdr->refcmdsn = be32_to_cpu(hdr->refcmdsn);
1642-
hdr->exp_datasn = be32_to_cpu(hdr->exp_datasn);
16431632
hdr->flags &= ~ISCSI_FLAG_CMD_FINAL;
16441633
function = hdr->flags;
16451634

@@ -1664,8 +1653,8 @@ static int iscsit_handle_task_mgt_cmd(
16641653
buf, conn);
16651654
}
16661655
if ((function != ISCSI_TM_FUNC_ABORT_TASK) &&
1667-
(hdr->refcmdsn != ISCSI_RESERVED_TAG))
1668-
hdr->refcmdsn = ISCSI_RESERVED_TAG;
1656+
be32_to_cpu(hdr->refcmdsn) != ISCSI_RESERVED_TAG)
1657+
hdr->refcmdsn = cpu_to_be32(ISCSI_RESERVED_TAG);
16691658

16701659
cmd = iscsit_allocate_cmd(conn, GFP_KERNEL);
16711660
if (!cmd)
@@ -1742,8 +1731,8 @@ static int iscsit_handle_task_mgt_cmd(
17421731
cmd->immediate_cmd = ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
17431732
cmd->init_task_tag = hdr->itt;
17441733
cmd->targ_xfer_tag = 0xFFFFFFFF;
1745-
cmd->cmd_sn = hdr->cmdsn;
1746-
cmd->exp_stat_sn = hdr->exp_statsn;
1734+
cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
1735+
cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
17471736
se_tmr = cmd->se_cmd.se_tmr_req;
17481737
tmr_req = cmd->tmr_req;
17491738
/*
@@ -1827,7 +1816,7 @@ static int iscsit_handle_task_mgt_cmd(
18271816
ISCSI_REASON_PROTOCOL_ERROR,
18281817
1, 0, buf, cmd);
18291818
}
1830-
iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
1819+
iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
18311820

18321821
if (out_of_order_cmdsn || !(hdr->opcode & ISCSI_OP_IMMEDIATE))
18331822
return 0;
@@ -1864,9 +1853,6 @@ static int iscsit_handle_text_cmd(
18641853

18651854
hdr = (struct iscsi_text *) buf;
18661855
payload_length = ntoh24(hdr->dlength);
1867-
hdr->ttt = be32_to_cpu(hdr->ttt);
1868-
hdr->cmdsn = be32_to_cpu(hdr->cmdsn);
1869-
hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
18701856

18711857
if (payload_length > conn->conn_ops->MaxXmitDataSegmentLength) {
18721858
pr_err("Unable to accept text parameter length: %u"
@@ -1983,15 +1969,15 @@ static int iscsit_handle_text_cmd(
19831969
cmd->immediate_cmd = ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
19841970
conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt;
19851971
cmd->targ_xfer_tag = 0xFFFFFFFF;
1986-
cmd->cmd_sn = hdr->cmdsn;
1987-
cmd->exp_stat_sn = hdr->exp_statsn;
1972+
cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
1973+
cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
19881974
cmd->data_direction = DMA_NONE;
19891975

19901976
spin_lock_bh(&conn->cmd_lock);
19911977
list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
19921978
spin_unlock_bh(&conn->cmd_lock);
19931979

1994-
iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
1980+
iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
19951981

19961982
if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
19971983
cmdsn_ret = iscsit_sequence_cmd(conn, cmd, hdr->cmdsn);
@@ -2125,9 +2111,6 @@ static int iscsit_handle_logout_cmd(
21252111

21262112
hdr = (struct iscsi_logout *) buf;
21272113
reason_code = (hdr->flags & 0x7f);
2128-
hdr->cid = be16_to_cpu(hdr->cid);
2129-
hdr->cmdsn = be32_to_cpu(hdr->cmdsn);
2130-
hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
21312114

21322115
if (tiqn) {
21332116
spin_lock(&tiqn->logout_stats.lock);
@@ -2159,9 +2142,9 @@ static int iscsit_handle_logout_cmd(
21592142
cmd->immediate_cmd = ((hdr->opcode & ISCSI_OP_IMMEDIATE) ? 1 : 0);
21602143
conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt;
21612144
cmd->targ_xfer_tag = 0xFFFFFFFF;
2162-
cmd->cmd_sn = hdr->cmdsn;
2163-
cmd->exp_stat_sn = hdr->exp_statsn;
2164-
cmd->logout_cid = hdr->cid;
2145+
cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
2146+
cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
2147+
cmd->logout_cid = be16_to_cpu(hdr->cid);
21652148
cmd->logout_reason = reason_code;
21662149
cmd->data_direction = DMA_NONE;
21672150

@@ -2171,15 +2154,15 @@ static int iscsit_handle_logout_cmd(
21712154
*/
21722155
if ((reason_code == ISCSI_LOGOUT_REASON_CLOSE_SESSION) ||
21732156
((reason_code == ISCSI_LOGOUT_REASON_CLOSE_CONNECTION) &&
2174-
(hdr->cid == conn->cid)))
2157+
be16_to_cpu(hdr->cid) == conn->cid))
21752158
logout_remove = 1;
21762159

21772160
spin_lock_bh(&conn->cmd_lock);
21782161
list_add_tail(&cmd->i_conn_node, &conn->conn_cmd_list);
21792162
spin_unlock_bh(&conn->cmd_lock);
21802163

21812164
if (reason_code != ISCSI_LOGOUT_REASON_RECOVERY)
2182-
iscsit_ack_from_expstatsn(conn, hdr->exp_statsn);
2165+
iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn));
21832166

21842167
/*
21852168
* Immediate commands are executed, well, immediately.
@@ -2212,10 +2195,6 @@ static int iscsit_handle_snack(
22122195

22132196
hdr = (struct iscsi_snack *) buf;
22142197
hdr->flags &= ~ISCSI_FLAG_CMD_FINAL;
2215-
hdr->ttt = be32_to_cpu(hdr->ttt);
2216-
hdr->exp_statsn = be32_to_cpu(hdr->exp_statsn);
2217-
hdr->begrun = be32_to_cpu(hdr->begrun);
2218-
hdr->runlength = be32_to_cpu(hdr->runlength);
22192198

22202199
pr_debug("Got ISCSI_INIT_SNACK, ITT: 0x%08x, ExpStatSN:"
22212200
" 0x%08x, Type: 0x%02x, BegRun: 0x%08x, RunLength: 0x%08x,"
@@ -2235,13 +2214,18 @@ static int iscsit_handle_snack(
22352214
switch (hdr->flags & ISCSI_FLAG_SNACK_TYPE_MASK) {
22362215
case 0:
22372216
return iscsit_handle_recovery_datain_or_r2t(conn, buf,
2238-
hdr->itt, hdr->ttt, hdr->begrun, hdr->runlength);
2217+
hdr->itt,
2218+
be32_to_cpu(hdr->ttt),
2219+
be32_to_cpu(hdr->begrun),
2220+
be32_to_cpu(hdr->runlength));
22392221
case ISCSI_FLAG_SNACK_TYPE_STATUS:
2240-
return iscsit_handle_status_snack(conn, hdr->itt, hdr->ttt,
2241-
hdr->begrun, hdr->runlength);
2222+
return iscsit_handle_status_snack(conn, hdr->itt,
2223+
be32_to_cpu(hdr->ttt),
2224+
be32_to_cpu(hdr->begrun), be32_to_cpu(hdr->runlength));
22422225
case ISCSI_FLAG_SNACK_TYPE_DATA_ACK:
2243-
return iscsit_handle_data_ack(conn, hdr->ttt, hdr->begrun,
2244-
hdr->runlength);
2226+
return iscsit_handle_data_ack(conn, be32_to_cpu(hdr->ttt),
2227+
be32_to_cpu(hdr->begrun),
2228+
be32_to_cpu(hdr->runlength));
22452229
case ISCSI_FLAG_SNACK_TYPE_RDATA:
22462230
/* FIXME: Support R-Data SNACK */
22472231
pr_err("R-Data SNACK Not Supported.\n");
@@ -2529,11 +2513,16 @@ static int iscsit_send_data_in(
25292513
put_unaligned_le64(0xFFFFFFFFFFFFFFFFULL, &hdr->lun);
25302514

25312515
hdr->itt = cmd->init_task_tag;
2532-
hdr->ttt = (hdr->flags & ISCSI_FLAG_DATA_ACK) ?
2533-
cpu_to_be32(cmd->targ_xfer_tag) :
2534-
0xFFFFFFFF;
2535-
hdr->statsn = (set_statsn) ? cpu_to_be32(cmd->stat_sn) :
2536-
0xFFFFFFFF;
2516+
2517+
if (hdr->flags & ISCSI_FLAG_DATA_ACK)
2518+
hdr->ttt = cpu_to_be32(cmd->targ_xfer_tag);
2519+
else
2520+
hdr->ttt = cpu_to_be32(0xFFFFFFFF);
2521+
if (set_statsn)
2522+
hdr->statsn = cpu_to_be32(cmd->stat_sn);
2523+
else
2524+
hdr->statsn = cpu_to_be32(0xFFFFFFFF);
2525+
25372526
hdr->exp_cmdsn = cpu_to_be32(conn->sess->exp_cmd_sn);
25382527
hdr->max_cmdsn = cpu_to_be32(conn->sess->max_cmd_sn);
25392528
hdr->datasn = cpu_to_be32(datain.data_sn);
@@ -3088,7 +3077,7 @@ static int iscsit_send_status(
30883077
cmd->se_cmd.scsi_sense_length += sizeof (__be16);
30893078

30903079
padding = -(cmd->se_cmd.scsi_sense_length) & 3;
3091-
hton24(hdr->dlength, cmd->se_cmd.scsi_sense_length);
3080+
hton24(hdr->dlength, (u32)cmd->se_cmd.scsi_sense_length);
30923081
iov[iov_count].iov_base = cmd->sense_buffer;
30933082
iov[iov_count++].iov_len =
30943083
(cmd->se_cmd.scsi_sense_length + padding);
@@ -3418,7 +3407,7 @@ static int iscsit_send_reject(
34183407
hdr->opcode = ISCSI_OP_REJECT;
34193408
hdr->flags |= ISCSI_FLAG_CMD_FINAL;
34203409
hton24(hdr->dlength, ISCSI_HDR_LEN);
3421-
hdr->ffffffff = 0xffffffff;
3410+
hdr->ffffffff = cpu_to_be32(0xffffffff);
34223411
cmd->stat_sn = conn->stat_sn++;
34233412
hdr->statsn = cpu_to_be32(cmd->stat_sn);
34243413
hdr->exp_cmdsn = cpu_to_be32(conn->sess->exp_cmd_sn);

‎drivers/target/iscsi/iscsi_target_core.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -479,7 +479,6 @@ struct iscsi_cmd {
479479

480480
struct iscsi_tmr_req {
481481
bool task_reassign:1;
482-
u32 ref_cmd_sn;
483482
u32 exp_data_sn;
484483
struct iscsi_cmd *ref_cmd;
485484
struct iscsi_conn_recovery *conn_recovery;

0 commit comments

Comments
 (0)