The SPC document states that "The COMMAND DATA LENGTH field indicates the
length in bytes of the command descriptor list".

The length should be subtracted by 4 to represent
the length of the description list, not 3

Signed-off-by: Chaohai Chen <wdhh66@163.com>
---
 drivers/target/target_core_spc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index ea14a3835681..61c065702350 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -2243,7 +2243,7 @@ spc_emulate_report_supp_op_codes(struct se_cmd *cmd)
 			response_length += spc_rsoc_encode_command_descriptor(
 					&buf[response_length], rctd, descr);
 		}
-		put_unaligned_be32(response_length - 3, buf);
+		put_unaligned_be32(response_length - 4, buf);
 	} else {
 		response_length = spc_rsoc_encode_one_command_descriptor(
 				&buf[response_length], rctd, descr,
-- 
2.34.1

On Wed, Jan 15, 2025 at 03:07:39PM +0800, Chaohai Chen wrote:
> The SPC document states that "The COMMAND DATA LENGTH field indicates the
> length in bytes of the command descriptor list".
> 
> The length should be subtracted by 4 to represent
> the length of the description list, not 3
> 
> Signed-off-by: Chaohai Chen <wdhh66@163.com>
> ---
>  drivers/target/target_core_spc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
> index ea14a3835681..61c065702350 100644
> --- a/drivers/target/target_core_spc.c
> +++ b/drivers/target/target_core_spc.c
> @@ -2243,7 +2243,7 @@ spc_emulate_report_supp_op_codes(struct se_cmd *cmd)
>                         response_length += spc_rsoc_encode_command_descriptor(
>                                         &buf[response_length], rctd, descr);
>                 }
> -               put_unaligned_be32(response_length - 3, buf);
> +               put_unaligned_be32(response_length - 4, buf);
>         } else {
>                 response_length = spc_rsoc_encode_one_command_descriptor(
>                                 &buf[response_length], rctd, descr,
> --
> 2.34.1
> 

Reviewed-by: Dmitry Bogdanov <d.bogdanov@yadro.com>