diff options
| author | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | 2009-04-03 09:12:20 +0900 |
|---|---|---|
| committer | James Bottomley <James.Bottomley@HansenPartnership.com> | 2009-04-03 09:25:23 -0500 |
| commit | 0fdf96b67ac2649cc1ddb29b316a0db11586c6a8 (patch) | |
| tree | e70a5d8babcae1ec25c0df0722291b31df62a7cb /drivers | |
| parent | f894e74dc1983062d30d4e1b79bdb90b8a847f52 (diff) | |
[SCSI] sg: fix iovec bugs introduced by the block layer conversion
- needs to use copy_from_user for iovec before passing it to
blk_rq_map_user_iov().
- before the block layer conversion, if ->dxfer_len and sum of iovec
disagrees, the shorter one wins. However, currently sg returns
-EINVAL. This restores the old behavior.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Cc: stable@kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/scsi/sg.c | 28 |
1 files changed, 24 insertions, 4 deletions
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index ffc87851f2e8..1e405184ed76 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1656,10 +1656,30 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd) md->null_mapped = hp->dxferp ? 0 : 1; } - if (iov_count) - res = blk_rq_map_user_iov(q, rq, md, hp->dxferp, iov_count, - hp->dxfer_len, GFP_ATOMIC); - else + if (iov_count) { + int len, size = sizeof(struct sg_iovec) * iov_count; + struct iovec *iov; + + iov = kmalloc(size, GFP_ATOMIC); + if (!iov) + return -ENOMEM; + + if (copy_from_user(iov, hp->dxferp, size)) { + kfree(iov); + return -EFAULT; + } + + len = iov_length(iov, iov_count); + if (hp->dxfer_len < len) { + iov_count = iov_shorten(iov, iov_count, hp->dxfer_len); + len = hp->dxfer_len; + } + + res = blk_rq_map_user_iov(q, rq, md, (struct sg_iovec *)iov, + iov_count, + len, GFP_ATOMIC); + kfree(iov); + } else res = blk_rq_map_user(q, rq, md, hp->dxferp, hp->dxfer_len, GFP_ATOMIC); |