Gleb Chesnokov b39d5ecb94 scst_lib: Bound UNMAP parsing by the parameter transfer
The UNMAP parser reads the descriptor length before checking that the
parameter header is present, and bounds descriptor reads by the CDB
length without checking the available SG data. A nonzero CDB length with
no buffer also succeeds silently. Reject short headers and transfers with
PARAMETER LIST LENGTH ERROR before reading any parameter data, while
preserving the zero-length command as a no-op.

SBC-3 section 5.26.2 requires an incomplete final UNMAP descriptor to be
ignored. The current multiple-of-16 check instead rejects the entire
command. Parse only complete descriptors within both the advertised
descriptor length and the CDB parameter length, as Linux target does.
Bound allocation and traversal by that same descriptor count.

Keep the existing KUnit expectations and enable the six short-transfer
cases previously skipped to avoid out-of-bounds reads. Add coverage for
zero-length CDBs with extra SG data, truncated headers across SG entries,
partial final descriptors and oversized descriptor-length fields. Fill
input descriptors independently of the expected output count.

Add shared Ginkgo cases over scst_local and TCP iSCSI using temporary
thin-provisioned fileio LUNs. Check target sense for short headers and
read back seeded ranges and guards to detect ignored valid descriptors,
unwanted discards and incomplete descriptors processed as complete ones.
Probe hole punching before export because fileio does not promise LBPRZ.
Keep SG_IO and CDB transfer lengths equal in these integration cases;
missing or split SG data remains covered by KUnit.

Fixes: 3b57904da6 ("Unify parsing of descriptors-based and internal commands")
2026-10-14 21:54:52 +03:00
2026-10-14 16:30:27 +03:00
2026-08-21 19:58:59 +03:00
2026-10-14 16:30:27 +03:00

SCST

Coverity Downloads

Overview

This is the source code repository of the SCST project. SCST is a collection of Linux kernel drivers that implement SCSI target functionality. The SCST project includes:

  1. The SCST core in the scst/ subdirectory.
  2. A tool for loading, saving and modifying the SCST configuration in directory scstadmin/.
  3. Several SCSI target drivers in the directories iscsi-scst/, qla2x00t-32gbit/, qla2x00t/, srpt/, scst_local/ and fcst/.
  4. User space programs in the usr/ subdirectory, e.g. fileio_tgt.
  5. Various documentation in the doc/ subdirectory.

Documentation

Current master packages

Prebuilt x86_64 packages from the latest successfully published master build are available in the rolling master-rpm prerelease. These are development snapshots, not SCST releases.

The snapshot contains RPM bundles for selected Rocky Linux and Oracle Linux UEK kernels. It also contains Ubuntu LTS bundles with scst-dkms, scstadmin and iscsi-scst binary packages and their Debian source package files. Exact distribution releases and RPM kernel versions are included in the asset names. Every .tar.gz bundle has a matching .sha256 file. The complete snapshot is replaced after each successful package workflow for the current master commit.

QLogic target driver

Two QLogic target drivers are included in the SCST project.

The default driver is located in the qla2x00t-32gbit directory. It is the newer one.

May anyone wish to switch back to the older driver that only supported up to 16 Gb/s adapters, it is located in qla2x00t directory. To make use of the older driver build scst with environment variable QLA_32GBIT=no set.

Vladislav Bolkhovitin vst@vlnb.net, http://scst.sourceforge.net

Sourceforge achievements

S
Description
No description provided
Readme
38 MiB
Languages
C 82.7%
Python 5.5%
Perl 3.6%
Go 2.9%
Shell 1.8%
Other 3.4%