Merge branch 'for-arm-soc-next' of git://git.linaro.org/people/ljones/linux-3.0-ux500 into next/dt

* 'for-arm-soc-next' of git://git.linaro.org/people/ljones/linux-3.0-ux500:
  ARM: ux500: Fix SSP register address format
  ARM: ux500: Apply tc3589x's GPIO/IRQ properties to HREF's DT
  ARM: ux500: Remove redundant #gpio-cell properties from Snowball DT
  ARM: ux500: Add all encompassing sound node to the HREF Device Tree
  ARM: ux500: Add nodes for the MSP into the HREF Device Tree
  ARM: ux500: Add all known I2C sub-device nodes to the HREF DT
  ARM: ux500: Stop registering I2C sub-devices for HREF when DT is enabled
  ARM: ux500: Stop registering Audio devices for HREF when DT is enabled
  ARM: ux500: Add all encompassing sound node to the Snowball Device Tree
  ARM: ux500: Add nodes for the MSP into Device Tree
  ARM: ux500: Rename MSP board file to something more meaningful
  ARM: ux500: Remove platform registration of MSP devices
  ARM: ux500: Stop registering the MOP500 Audio driver from platform code
  ARM: ux500: Pass MSP DMA platform data though AUXDATA
  ARM: ux500: Fork MSP platform registration for step-by-step DT enablement
  ARM: ux500: Add AB8500 CODEC node to DB8500 Device Tree
  ARM: ux500: Clean-up MSP platform code
  ARM: ux500: Pass SDI DMA information though AUX_DATA to MMCI
  ARM: ux500: Add UART support to the HREF Device Tree
  ARM: ux500: Add skeleton Device Tree for the HREF reference board
  ...
  + sync to v3.6-rc6

1 files changed, 15 insertions, 2 deletions

diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 76db75e836ed..9ba495477fd2 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -325,17 +325,30 @@ static int iblock_execute_unmap(struct se_cmd *cmd)
         struct iblock_dev *ibd = dev->dev_ptr;
         unsigned char *buf, *ptr = NULL;
         sector_t lba;
-        int size = cmd->data_length;
+        int size;
         u32 range;
         int ret = 0;
         int dl, bd_dl;
 
+        if (cmd->data_length < 8) {
+                pr_warn("UNMAP parameter list length %u too small\n",
+                        cmd->data_length);
+                cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
+                return -EINVAL;
+        }
+
         buf = transport_kmap_data_sg(cmd);
 
         dl = get_unaligned_be16(&buf[0]);
         bd_dl = get_unaligned_be16(&buf[2]);
 
-        size = min(size - 8, bd_dl);
+        size = cmd->data_length - 8;
+        if (bd_dl > size)
+                pr_warn("UNMAP parameter list length %u too small, ignoring bd_dl %u\n",
+                        cmd->data_length, bd_dl);
+        else
+                size = bd_dl;
+
         if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) {
                 cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST;
                 ret = -EINVAL;