[PATCH] scsi: scsi_dh_alua: validate RTPG descriptors

[Pengpeng Hou]

From: Pengpeng <pengpeng@xxxxxxxxxxx>

alua_rtpg() walks REPORT TARGET PORT GROUPS descriptors using the
response length, but the loop reads descriptor bytes 2 and 7 before
proving that the current descriptor has the fixed eight-byte header.

Stop parsing a truncated trailing descriptor before reading its group id,
state fields or relative target port count.

Signed-off-by: Pengpeng <pengpeng@xxxxxxxxxxx>
---
 drivers/scsi/device_handler/scsi_dh_alua.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 80ab0ff921d4..f63f32bad12a 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -681,7 +681,12 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
 	for (k = tpg_desc_tbl_off, desc = buff + tpg_desc_tbl_off;
 	     k < len;
 	     k += off, desc += off) {
-		u16 group_id = get_unaligned_be16(&desc[2]);
+		u16 group_id;
+
+		if (len - k < 8)
+			break;
+
+		group_id = get_unaligned_be16(&desc[2]);
 
 		spin_lock_irqsave(&port_group_lock, flags);
 		tmp_pg = alua_find_get_pg(pg->device_id_str, pg->device_id_len,
-- 
2.43.0