A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 11:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

[SCSI] sg: Free data buffers after calling blk_rq_unmap_user

Browse source 
Running sg_luns on s390x with CONFIG_DEBUG_PAGEALLOC enabled fails
with EFAULT from the SG_IO ioctl. The EFAULT is the result from
copy_to_user failing in this call chain:

sg_ioctl
sg_new_read
sg_finish_rem_req
blk_rq_unmap_user
__blk_rq_unmap_user
bio_uncopy_user
__bio_copy_iov
copy_to_user

The sg driver calls sg_remove_scat to free the memory pages before
calling blk_rq_unmap_user that tries to copy the data back to
userspace. Change the order to first call blk_rq_unmap_user before
freeing the pages in sg_remove_scat.

Acked-by: FUJITA Tomonori <[email protected]>
Cc: [email protected]
Signed-off-by: Christof Schmitt <[email protected]>
Acked-by: Douglas Gilbert <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
This commit is contained in:
Christof Schmitt 2009-09-17 09:10:14 +02:00 • committed by James Bottomley
commit e27168f8c3
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/scsi/sg.c
View file

@ -1708,11 +1708,6 @@ static int sg_finish_rem_req(Sg_request * srp)
Sg_scatter_hold *req_schp = &srp->data;
SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
if (srp->res_used)
sg_unlink_reserve(sfp, srp);
else
sg_remove_scat(req_schp);
if (srp->rq) {
if (srp->bio)
ret = blk_rq_unmap_user(srp->bio);
@ -1720,6 +1715,11 @@ static int sg_finish_rem_req(Sg_request * srp)
blk_put_request(srp->rq);
}
if (srp->res_used)
sg_unlink_reserve(sfp, srp);
else
sg_remove_scat(req_schp);
sg_remove_request(sfp, srp);
return ret;