From 92639ea74347347ca5936d789cf79ad25aec7a23 Mon Sep 17 00:00:00 2001
From: lishiao <1447175116@qq.com>
Date: Thu, 12 Jun 2025 16:55:00 +0800
Subject: [PATCH] enforce MaxBurstLength limit in iscsi_data_rsp_build

---
 usr/iscsi/iscsid.c | 16 +++++++++++++---
 usr/scsi_cmnd.h    |  2 ++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/usr/iscsi/iscsid.c b/usr/iscsi/iscsid.c
index 6f3ae3c7..5aeedfc7 100644
--- a/usr/iscsi/iscsid.c
+++ b/usr/iscsi/iscsid.c
@@ -1108,7 +1108,7 @@ static int iscsi_data_rsp_build(struct iscsi_task *task)
 {
 	struct iscsi_connection *conn = task->conn;
 	struct iscsi_data_rsp *rsp = (struct iscsi_data_rsp *) &conn->rsp.bhs;
-	int datalen, maxdatalen;
+	uint32_t datalen, maxdatalen;
 	int result = scsi_get_result(&task->scmd);
 
 	memset(rsp, 0, sizeof(*rsp));
@@ -1123,7 +1123,7 @@ static int iscsi_data_rsp_build(struct iscsi_task *task)
 
 	maxdatalen = conn->tp->rdma ?
 		conn->session_param[ISCSI_PARAM_MAX_BURST].val :
-		conn->session_param[ISCSI_PARAM_MAX_XMIT_DLENGTH].val;
+		min_t(uint32_t, conn->session_param[ISCSI_PARAM_MAX_XMIT_DLENGTH].val, conn->session_param[ISCSI_PARAM_MAX_BURST].val - scsi_get_in_sequence_len(&task->scmd));
 
 	dprintf("%d %d %d %" PRIu32 "%x\n", datalen,
 		scsi_get_in_transfer_len(&task->scmd), task->offset, maxdatalen,
@@ -1141,8 +1141,18 @@ static int iscsi_data_rsp_build(struct iscsi_task *task)
 			rsp->statsn = cpu_to_be32(conn->stat_sn++);
 			iscsi_set_data_rsp_residual(rsp, &task->scmd);
 		}
-	} else
+	}
+	else
+	{
 		datalen = maxdatalen;
+		scsi_set_in_sequence_len(&task->scmd, scsi_get_in_sequence_len(&task->scmd) + datalen);
+		if (scsi_get_in_sequence_len(&task->scmd) == conn->session_param[ISCSI_PARAM_MAX_BURST].val)
+		{
+			scsi_set_in_sequence_len(&task->scmd, 0);
+			rsp->flags = ISCSI_FLAG_CMD_FINAL;
+		}
+		rsp->statsn = cpu_to_be32(ISCSI_RESERVED_TAG);
+	}
 
 	rsp->exp_cmdsn = cpu_to_be32(conn->session->exp_cmd_sn);
 	rsp->max_cmdsn = cpu_to_be32(conn->session->exp_cmd_sn +
diff --git a/usr/scsi_cmnd.h b/usr/scsi_cmnd.h
index 8bdcb19e..ea9de2bf 100644
--- a/usr/scsi_cmnd.h
+++ b/usr/scsi_cmnd.h
@@ -15,6 +15,7 @@ struct scsi_data_buffer {
 	uint64_t buffer;
 	uint32_t length;
 	uint32_t transfer_len;
+	uint32_t sequence_len;
 	int32_t resid;
 };
 
@@ -83,6 +84,7 @@ static inline type scsi_get_##dir##_##field(struct scsi_cmd *scmd)		\
 
 scsi_data_buffer_accessor(length, uint32_t, ,);
 scsi_data_buffer_accessor(transfer_len, uint32_t, ,);
+scsi_data_buffer_accessor(sequence_len, uint32_t, , );
 scsi_data_buffer_accessor(resid, int32_t, ,);
 scsi_data_buffer_accessor(buffer, void *, (unsigned long), (void *)(unsigned long));