Commit 108c373f authored by Shuhei Matsumoto's avatar Shuhei Matsumoto Committed by Tomasz Zawadzki
Browse files

lib/iscsi: Move checking header digests before handling payload 



If PDU header digest error is detected, it indicates that the length
field of the header may have been corrupted. Hence it's may not be
possible to identify the location of the beginning of a later PDU.

So move checking header digest before handling payload and then
close the connection if header digest error is detected.

Signed-off-by: default avatarShuhei Matsumoto <shuhei.matsumoto.xt@hitachi.com>
Change-Id: I56f6bc082dc0b244e71ad996b4da08e0203f8cdd
Reviewed-on: https://review.gerrithub.io/c/spdk/spdk/+/471014


Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
Reviewed-by: default avatarChangpeng Liu <changpeng.liu@intel.com>
parent 52e2b86b

lib/iscsi/iscsi.c

+10 −9
Original line number Diff line number Diff line
@@ -4651,6 +4651,15 @@ spdk_iscsi_read_pdu(struct spdk_iscsi_conn *conn) 
		}

	}



	if (conn->header_digest) {

		crc32c = spdk_iscsi_pdu_calc_header_digest(pdu);

		rc = MATCH_DIGEST_WORD(pdu->header_digest, crc32c);

		if (rc == 0) {

			SPDK_ERRLOG("header digest error (%s)\n", conn->initiator_name);

			goto error;

		}

	}



	data_len = ISCSI_ALIGN(DGET24(pdu->bhs.data_segment_len));



	if (data_len != 0 && pdu->data_buf == NULL) {
@@ -4714,15 +4723,7 @@ spdk_iscsi_read_pdu(struct spdk_iscsi_conn *conn) 
	spdk_trace_record(TRACE_ISCSI_READ_PDU, conn->id, pdu->data_valid_bytes,

			  (uintptr_t)pdu, pdu->bhs.opcode);



	/* check digest */

	if (conn->header_digest) {

		crc32c = spdk_iscsi_pdu_calc_header_digest(pdu);

		rc = MATCH_DIGEST_WORD(pdu->header_digest, crc32c);

		if (rc == 0) {

			SPDK_ERRLOG("header digest error (%s)\n", conn->initiator_name);

			goto error;

		}

	}

	/* check data digest */

	if (conn->data_digest && data_len != 0) {

		crc32c = spdk_iscsi_pdu_calc_data_digest(pdu);

		rc = MATCH_DIGEST_WORD(pdu->data_digest, crc32c);