Re: [PATCH v4 1/4] scsi: target: rd: Fix oversized sg table array allocation

[Ran Hongyun]

Hi Sanan,

Thanks for the patch. One question about rd_build_prot_space():

The totalram_pages() check is only added in rd_build_device_space(), but
rd_build_prot_space() is also reachable with an inflated rd_page_count
that exceeds totalram_pages(), via:

  1. echo "rd_pages=1024" > control   (valid value)
  2. echo 1 > enable                   (rd_build_device_space succeeds,
                                        DF_CONFIGURED set)
  3. echo "rd_pages=-1" > control      (rd_page_count overwritten to
                                        UINT_MAX, no configured check in
                                        target_dev_control_store)
  4. echo 1 > pi_prot_type             (triggers rd_build_prot_space with
                                        the tampered rd_page_count)

In step 4, rd_build_prot_space() proceeds with the impossible page count
and attempts alloc_pages(), failing mid-way with -ENOMEM.

Should rd_build_prot_space() also get the totalram_pages() check to
reject impossible values early?

Thanks,
Ran Hongyun