redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

[SCSI] scsi_debug: fix invalid address passed to kunmap_atomic()

Browse source 
In the function prot_verify_write(), the kmap address 'daddr' is
incremented in the loop for each data page.  Finally 'daddr' reaches
the next page boundary in the end of the loop, and the invalid address
is passed to kunmap_atomic().

Fix the issue by not incrementing 'daddr' in the loop and offsetting it
by the loop counter on demand.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: "Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This commit is contained in:
Akinobu Mita 2013-06-29 17:59:14 +09:00 committed by James Bottomley
parent e9ce9c86c2
commit 518d9df871
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/scsi/scsi_debug.c
View file

@ -1899,7 +1899,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
daddr = kmap_atomic(sg_page(dsgl)) + dsgl->offset;
/* For each sector-sized chunk in data page */
for (j = 0 ; j < dsgl->length ; j += scsi_debug_sector_size) {
for (j = 0; j < dsgl->length; j += scsi_debug_sector_size) {
/* If we're at the end of the current
* protection page advance to the next one
@ -1917,11 +1917,11 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
switch (scsi_debug_guard) {
case 1:
csum = ip_compute_csum(daddr,
csum = ip_compute_csum(daddr + j,
scsi_debug_sector_size);
break;
case 0:
csum = cpu_to_be16(crc_t10dif(daddr,
csum = cpu_to_be16(crc_t10dif(daddr + j,
scsi_debug_sector_size));
break;
default:
@ -1938,7 +1938,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
be16_to_cpu(sdt->guard_tag),
be16_to_cpu(csum));
ret = 0x01;
dump_sector(daddr, scsi_debug_sector_size);
dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@ -1949,7 +1949,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
"%s: REF check failed on sector %lu\n",
__func__, (unsigned long)sector);
ret = 0x03;
dump_sector(daddr, scsi_debug_sector_size);
dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@ -1959,7 +1959,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
"%s: REF check failed on sector %lu\n",
__func__, (unsigned long)sector);
ret = 0x03;
dump_sector(daddr, scsi_debug_sector_size);
dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@ -1977,7 +1977,6 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
start_sec++;
ei_lba++;
daddr += scsi_debug_sector_size;
ppage_offset += sizeof(struct sd_dif_tuple);
}