Junrui Luo c08ab702c4 scsi: target: core: Fix integer overflow in UNMAP bounds check ...

[ Upstream commit 2bf2d65f76 ]

sbc_execute_unmap() checks LBA + range does not exceed the device capacity,
but does not guard against LBA + range wrapping around on 64-bit overflow.

Add an overflow check matching the pattern already used for WRITE_SAME in
the same file.

Fixes: 86d7182985 ("target: Add sbc_execute_unmap() helper")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881593C61AD52C69FBDB0BDAF7CA@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:29:37 +02:00

..

iscsi

scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

2026-02-11 13:34:23 +01:00

loopback

…

sbp

scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()

2026-02-06 16:40:11 +01:00

tcm_fc

…

Kconfig

…

Makefile

…

target_core_alua.c

…

target_core_alua.h

…

target_core_configfs.c

scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

2026-06-01 17:29:21 +02:00

target_core_device.c

…

target_core_fabric_configfs.c

…

target_core_fabric_lib.c

…

target_core_file.c

…

target_core_file.h

…

target_core_hba.c

…

target_core_iblock.c

…

target_core_iblock.h

…

target_core_internal.h

…

target_core_pr.c

…

target_core_pr.h

…

target_core_pscsi.c

…

target_core_pscsi.h

…

target_core_rd.c

…

target_core_rd.h

…

target_core_sbc.c

scsi: target: core: Fix integer overflow in UNMAP bounds check

2026-06-01 17:29:37 +02:00

target_core_spc.c

…

target_core_stat.c

…

target_core_tmr.c

…

target_core_tpg.c

…

target_core_transport.c

scsi: target: Reset t_task_cdb pointer in error case

2026-01-19 13:11:49 +01:00

target_core_ua.c

…

target_core_ua.h

…

target_core_user.c

…

target_core_xcopy.c

…

target_core_xcopy.h

…