diff options
| author | Akinobu Mita <akinobu.mita@gmail.com> | 2015-05-01 15:23:48 +0900 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2015-05-30 22:42:23 -0700 |
| commit | 57636388af32c2c7db3919e8d53f4979b7c7c307 (patch) | |
| tree | 0ce8ebfdf5e3d95b2a6a2a9145964a97f31f9440 | |
| parent | 144bc4c2a42a0f42a32c106d53f5bf2724fbf098 (diff) | |
| download | linux-stable-57636388af32c2c7db3919e8d53f4979b7c7c307.tar.gz linux-stable-57636388af32c2c7db3919e8d53f4979b7c7c307.tar.bz2 linux-stable-57636388af32c2c7db3919e8d53f4979b7c7c307.zip | |
target: Fix inconsistent address passed to kunmap_atomic() in sbc_dif_copy_prot()
In sbc_dif_copy_prot(), the addresses passed to kunmap_atomic() are
inconsistent with the addresses which are mapped by kmap_atomic().
That could be problematic if an SG element has its length larger than
PAGE_SIZE as kunmap_atomic() will attempt to unmap different page.
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
Cc: target-devel@vger.kernel.org
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
| -rw-r--r-- | drivers/target/target_core_sbc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c index d441975604db..d615a11dc9c9 100644 --- a/drivers/target/target_core_sbc.c +++ b/drivers/target/target_core_sbc.c @@ -1300,13 +1300,14 @@ void sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read, copied += len; psg_len -= len; + kunmap_atomic(addr - sg->offset - offset); + if (offset >= sg->length) { sg = sg_next(sg); offset = 0; } - kunmap_atomic(addr); } - kunmap_atomic(paddr); + kunmap_atomic(paddr - psg->offset); } } EXPORT_SYMBOL(sbc_dif_copy_prot); |