[PATCH] scsi: core: reject short REPORT LUNS responses

[shao.mingyin]

scsi_report_lun_scan() allocates the REPORT LUNS buffer with kmalloc()
and does not ask scsi_execute_cmd() for the residual count.  A device that
completes the command successfully after transferring fewer than the eight
bytes of the LUN list header leaves the header uninitialized; the bogus
length read from it can trigger a multi-gigabyte kmalloc() retry or probe
LUNs that do not exist.

Request the residual and abort the scan when the header was not
transferred.

Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 52f3b525d2fd..abbcf529bdc4 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1475,10 +1475,11 @@ static int scsi_report_lun_scan(struct Scsi_Host *shost,
 		.total_allowed = 3,
 		.failure_definitions = failure_defs,
 	};
+	int ret = 0, resid = 0;
 	const struct scsi_exec_args exec_args = {
+		.resid = &resid,
 		.failures = &failures,
 	};
-	int ret = 0;
 
 	/*
 	 * Only support SCSI-3 and up devices if BLIST_NOREPORTLUN is not set.
@@ -1567,6 +1568,12 @@ static int scsi_report_lun_scan(struct Scsi_Host *shost,
 		goto out_err;
 	}
 
+	if (resid > length - sizeof(struct scsi_lun)) {
+		/* Short transfer: the LUN list header was not filled in. */
+		ret = 1;
+		goto out_err;
+	}
+
 	/*
 	 * Get the length from the first four bytes of lun_data.
 	 */