diff options
| author | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | 2008-12-18 14:49:36 +0900 |
|---|---|---|
| committer | James Bottomley <James.Bottomley@HansenPartnership.com> | 2009-01-02 11:09:41 -0600 |
| commit | e623ddb4e940b266adc77ba1cc28a3554aa90e79 (patch) | |
| tree | 62c245b32720573d97718795b0c8165cad967b05 /fs | |
| parent | 4f10aae0d1a285df6b16bf6ca5abd366140fd371 (diff) | |
| download | linux-e623ddb4e940b266adc77ba1cc28a3554aa90e79.tar.gz linux-e623ddb4e940b266adc77ba1cc28a3554aa90e79.tar.bz2 linux-e623ddb4e940b266adc77ba1cc28a3554aa90e79.zip | |
[SCSI] block: fix bio_add_page misuse with rq_map_data
This fixes bio_add_page misuse in bio_copy_user_iov with rq_map_data,
which only sg uses now.
rq_map_data carries page frames for bio_add_pc_page. bio_copy_user_iov
uses bio_add_pc_page with a larger size than PAGE_SIZE. It's clearly
wrong.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/bio.c | 26 |
1 files changed, 14 insertions, 12 deletions
@@ -815,28 +815,30 @@ struct bio *bio_copy_user_iov(struct request_queue *q, ret = 0; i = 0; + if (map_data) + nr_pages = 1 << map_data->page_order; while (len) { - unsigned int bytes; - - if (map_data) - bytes = 1U << (PAGE_SHIFT + map_data->page_order); - else - bytes = PAGE_SIZE; + unsigned int bytes = PAGE_SIZE; if (bytes > len) bytes = len; if (map_data) { - if (i == map_data->nr_entries) { + if (i == map_data->nr_entries * nr_pages) { ret = -ENOMEM; break; } - page = map_data->pages[i++]; - } else + + page = map_data->pages[i / nr_pages]; + page += (i % nr_pages); + + i++; + } else { page = alloc_page(q->bounce_gfp | gfp_mask); - if (!page) { - ret = -ENOMEM; - break; + if (!page) { + ret = -ENOMEM; + break; + } } if (bio_add_pc_page(q, bio, page, bytes, 0) < bytes) |