[SCSI] iscsi bugfixes: handle data rsp errors

if iscsi_data_rsp fails we must bail out. Since the pdu values like
data length are invalid we cannot continue to process the data since
it could over run buffers.

This fixes a bug with cisco 5428s where that target is sending
too much data.

Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index ab324d984b8d6d6922be5bd63eff35c3351a75f3..7d784596a1eabdf7629cb259a2212102a704278d 100644 (file)
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -486,6 +486,8 @@ iscsi_tcp_hdr_recv(struct iscsi_conn *conn)
        case ISCSI_OP_SCSI_DATA_IN:
                tcp_conn->in.ctask = session->cmds[itt];
                rc = iscsi_data_rsp(conn, tcp_conn->in.ctask);
+               if (rc)
+                       return rc;
                /* fall through */
        case ISCSI_OP_SCSI_CMD_RSP:
                tcp_conn->in.ctask = session->cmds[itt];
@@ -532,7 +534,7 @@ copy_hdr:
         * skbs to complete the command then we have to copy the header
         * for later use
         */
-       if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <
+       if (tcp_conn->in.zero_copy_hdr && tcp_conn->in.copy <=
           (tcp_conn->in.datalen + tcp_conn->in.padding +
            (conn->datadgst_en ? 4 : 0))) {
                debug_tcp("Copying header for later use. in.copy %d in.datalen"