Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two iscsi fixes.

  One for an oops in the client which can be triggered by the server
  authentication protocol and the other in the target code which causes
  data corruption"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported
  scsi: target/iblock: Fix overrun in WRITE SAME emulation

diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index b6e4862cc24272f08f9795eb27a193ada86eb436..51ddca2033e0aad75c9b38e70b1d60b8970b5ccc 100644 (file)
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -81,6 +81,12 @@ out:
        return CHAP_DIGEST_UNKNOWN;
 }
 
+static void chap_close(struct iscsi_conn *conn)
+{
+       kfree(conn->auth_protocol);
+       conn->auth_protocol = NULL;
+}
+
 static struct iscsi_chap *chap_server_open(
        struct iscsi_conn *conn,
        struct iscsi_node_auth *auth,
@@ -118,7 +124,7 @@ static struct iscsi_chap *chap_server_open(
        case CHAP_DIGEST_UNKNOWN:
        default:
                pr_err("Unsupported CHAP_A value\n");
-               kfree(conn->auth_protocol);
+               chap_close(conn);
                return NULL;
        }
 
@@ -133,19 +139,13 @@ static struct iscsi_chap *chap_server_open(
         * Generate Challenge.
         */
        if (chap_gen_challenge(conn, 1, aic_str, aic_len) < 0) {
-               kfree(conn->auth_protocol);
+               chap_close(conn);
                return NULL;
        }
 
        return chap;
 }
 
-static void chap_close(struct iscsi_conn *conn)
-{
-       kfree(conn->auth_protocol);
-       conn->auth_protocol = NULL;
-}
-
 static int chap_server_compute_md5(
        struct iscsi_conn *conn,
        struct iscsi_node_auth *auth,

diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index f4a075303e9ad488fc921299603f9f4c74bce8a8..6949ea8bc387c7acac2571862d36f0c3f2e0ca04 100644 (file)
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -502,7 +502,7 @@ iblock_execute_write_same(struct se_cmd *cmd)
 
                /* Always in 512 byte units for Linux/Block */
                block_lba += sg->length >> SECTOR_SHIFT;
-               sectors -= 1;
+               sectors -= sg->length >> SECTOR_SHIFT;
        }
 
        iblock_submit_bios(&list);