Tony Battersby f9de3f4169 scst: Fix parsing of CDB control byte
SCST_GET_CDB_LEN() returns 0 for vendor-specific opcodes such as:

0xD1 READ DYN RUNTIME ATT
0xD2 WRITE DYN RUNTIME ATTR
0xE7 INIT ELEMENT STATUS WRANGE

This causes scst_set_cmd_from_cdb_info() to check cdb[-1] for the
control byte, causing an out-of-bounds array read.

- Move the parsing of the control byte after get_cdb_info() since that
  may set the CDB length to a known value.

- If the CDB length is still unknown, then assume the control byte is
  0 without accessing the CDB.

- Check for variable-length CDBs in scst_set_cmd_from_cdb_info() rather
  than using the wrong control byte and then overriding it in
  get_cdb_info_var_len().  This is necessary because the override would
  no longer work after the change above.

Also, the following code doesn't work:

    #define CONTROL_BYTE_NACA_BIT 0x04
    unsigned int cmd_naca:1;
    cmd_naca = (control & CONTROL_BYTE_NACA_BIT);

The result will always be 0.  Use this instead:

    cmd_naca = !!(control & CONTROL_BYTE_NACA_BIT);

(cmd_linked happened to work because CONTROL_BYTE_LINK_BIT is 0x01, but
apply the same fix there also for consistency).

Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
2025-09-08 16:40:12 +03:00
2023-04-28 15:22:58 +03:00
2024-12-28 17:14:54 +03:00
2025-09-08 16:40:12 +03:00
2025-09-08 16:40:12 +03:00
2025-05-14 18:36:46 +03:00

SCST

Coverity Downloads

Overview

This is the source code repository of the SCST project. SCST is a collection of Linux kernel drivers that implement SCSI target functionality. The SCST project includes:

  1. The SCST core in the scst/ subdirectory.
  2. A tool for loading, saving and modifying the SCST configuration in directory scstadmin/.
  3. Several SCSI target drivers in the directories iscsi-scst/, qla2x00t/, srpt/, scst_local/ and fcst/.
  4. User space programs in the usr/ subdirectory, e.g. fileio_tgt.
  5. Various documentation in the doc/ subdirectory.

Instructions for building and installing SCST are available in the INSTALL.md file.

QLogic target driver

Two QLogic target drivers are included in the SCST project.

The default driver is located in qla2x00t-32gbit directory and it supports up to 32 Gb/s FC. It is the newer one.

May anyone wish to switch back to the older driver that only supported up to 16 Gb/s adapters, it is located in qla2x00t directory. To make use of the older driver build scst with environment variable QLA_32GBIT=no set.

Vladislav Bolkhovitin vst@vlnb.net, http://scst.sourceforge.net

Sourceforge achievements

S
Description
No description provided
Readme 32 MiB
Languages
C 90.1%
Perl 4.2%
Shell 1.8%
HTML 1.7%
Makefile 1.2%
Other 0.9%