Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c982c368 authored by FUJITA Tomonori's avatar FUJITA Tomonori Committed by James Bottomley
Browse files

[SCSI] st: fix mdata->page_order handling 

dio transfer always resets mdata->page_order to zero. It breaks
high-order pages previously allocated for non-dio transfer.

This patches adds reserved_page_order to st_buffer structure to save
page order for non-dio transfer.

http://bugzilla.kernel.org/show_bug.cgi?id=14563



When enlarge_buffer() allocates 524288 from 0, st uses six-order page
allocation. So mdata->page_order is 6 and frp_seg is 2.

After that, if st uses dio, sgl_map_user_pages() sets
mdata->page_order to 0 for st_do_scsi(). After that, when we call
normalize_buffer(), it frees only free frp_seg * PAGE_SIZE (2 * 4096)
though we should free frp_seg * PAGE_SIZE << 6 (2 * 4096 << 6). So we
see buffer_size is set to 516096 (524288 - 8192).

Reported-by: default avatarJoachim Breuer <linux-kernel@jmbreuer.net>
Tested-by: default avatarJoachim Breuer <linux-kernel@jmbreuer.net>
Acked-by: default avatarKai Makisara <kai.makisara@kolumbus.fi>
Signed-off-by: default avatarFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: stable@kernel.org
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 78b9fb6d

drivers/scsi/st.c

+12 −11
Original line number Original line Diff line number Diff line
@@ -552,13 +552,15 @@ st_do_scsi(struct st_request * SRpnt, struct scsi_tape * STp, unsigned char *cmd 
	SRpnt->waiting = waiting;

	SRpnt->waiting = waiting;





	if (STp->buffer->do_dio) {

	if (STp->buffer->do_dio) {

		mdata->page_order = 0;

		mdata->nr_entries = STp->buffer->sg_segs;

		mdata->nr_entries = STp->buffer->sg_segs;

		mdata->pages = STp->buffer->mapped_pages;

		mdata->pages = STp->buffer->mapped_pages;

	} else {

	} else {

		mdata->page_order = STp->buffer->reserved_page_order;

		mdata->nr_entries =

		mdata->nr_entries =

			DIV_ROUND_UP(bytes, PAGE_SIZE << mdata->page_order);

			DIV_ROUND_UP(bytes, PAGE_SIZE << mdata->page_order);

		STp->buffer->map_data.pages = STp->buffer->reserved_pages;

		mdata->pages = STp->buffer->reserved_pages;

		STp->buffer->map_data.offset = 0;

		mdata->offset = 0;

	}

	}





	memcpy(SRpnt->cmd, cmd, sizeof(SRpnt->cmd));

	memcpy(SRpnt->cmd, cmd, sizeof(SRpnt->cmd));
@@ -3719,7 +3721,7 @@ static int enlarge_buffer(struct st_buffer * STbuffer, int new_size, int need_dm 
		priority |= __GFP_ZERO;

		priority |= __GFP_ZERO;





	if (STbuffer->frp_segs) {

	if (STbuffer->frp_segs) {

		order = STbuffer->map_data.page_order;

		order = STbuffer->reserved_page_order;

		b_size = PAGE_SIZE << order;

		b_size = PAGE_SIZE << order;

	} else {

	} else {

		for (b_size = PAGE_SIZE, order = 0;

		for (b_size = PAGE_SIZE, order = 0;
@@ -3752,7 +3754,7 @@ static int enlarge_buffer(struct st_buffer * STbuffer, int new_size, int need_dm 
		segs++;

		segs++;

	}

	}

	STbuffer->b_data = page_address(STbuffer->reserved_pages[0]);

	STbuffer->b_data = page_address(STbuffer->reserved_pages[0]);

	STbuffer->map_data.page_order = order;

	STbuffer->reserved_page_order = order;





	return 1;

	return 1;

}

}
@@ -3765,7 +3767,7 @@ static void clear_buffer(struct st_buffer * st_bp) 




	for (i=0; i < st_bp->frp_segs; i++)

	for (i=0; i < st_bp->frp_segs; i++)

		memset(page_address(st_bp->reserved_pages[i]), 0,

		memset(page_address(st_bp->reserved_pages[i]), 0,

		       PAGE_SIZE << st_bp->map_data.page_order);

		       PAGE_SIZE << st_bp->reserved_page_order);

	st_bp->cleared = 1;

	st_bp->cleared = 1;

}

}
@@ -3773,7 +3775,7 @@ static void clear_buffer(struct st_buffer * st_bp) 
/* Release the extra buffer */

/* Release the extra buffer */

static void normalize_buffer(struct st_buffer * STbuffer)

static void normalize_buffer(struct st_buffer * STbuffer)

{

{

	int i, order = STbuffer->map_data.page_order;

	int i, order = STbuffer->reserved_page_order;





	for (i = 0; i < STbuffer->frp_segs; i++) {

	for (i = 0; i < STbuffer->frp_segs; i++) {

		__free_pages(STbuffer->reserved_pages[i], order);

		__free_pages(STbuffer->reserved_pages[i], order);
@@ -3781,7 +3783,7 @@ static void normalize_buffer(struct st_buffer * STbuffer) 
	}

	}

	STbuffer->frp_segs = 0;

	STbuffer->frp_segs = 0;

	STbuffer->sg_segs = 0;

	STbuffer->sg_segs = 0;

	STbuffer->map_data.page_order = 0;

	STbuffer->reserved_page_order = 0;

	STbuffer->map_data.offset = 0;

	STbuffer->map_data.offset = 0;

}

}
@@ -3791,7 +3793,7 @@ static void normalize_buffer(struct st_buffer * STbuffer) 
static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, int do_count)

static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, int do_count)

{

{

	int i, cnt, res, offset;

	int i, cnt, res, offset;

	int length = PAGE_SIZE << st_bp->map_data.page_order;

	int length = PAGE_SIZE << st_bp->reserved_page_order;





	for (i = 0, offset = st_bp->buffer_bytes;

	for (i = 0, offset = st_bp->buffer_bytes;

	     i < st_bp->frp_segs && offset >= length; i++)

	     i < st_bp->frp_segs && offset >= length; i++)
@@ -3823,7 +3825,7 @@ static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, in 
static int from_buffer(struct st_buffer * st_bp, char __user *ubp, int do_count)

static int from_buffer(struct st_buffer * st_bp, char __user *ubp, int do_count)

{

{

	int i, cnt, res, offset;

	int i, cnt, res, offset;

	int length = PAGE_SIZE << st_bp->map_data.page_order;

	int length = PAGE_SIZE << st_bp->reserved_page_order;





	for (i = 0, offset = st_bp->read_pointer;

	for (i = 0, offset = st_bp->read_pointer;

	     i < st_bp->frp_segs && offset >= length; i++)

	     i < st_bp->frp_segs && offset >= length; i++)
@@ -3856,7 +3858,7 @@ static void move_buffer_data(struct st_buffer * st_bp, int offset) 
{

{

	int src_seg, dst_seg, src_offset = 0, dst_offset;

	int src_seg, dst_seg, src_offset = 0, dst_offset;

	int count, total;

	int count, total;

	int length = PAGE_SIZE << st_bp->map_data.page_order;

	int length = PAGE_SIZE << st_bp->reserved_page_order;





	if (offset == 0)

	if (offset == 0)

		return;

		return;
@@ -4578,7 +4580,6 @@ static int sgl_map_user_pages(struct st_buffer *STbp, 
        }

        }





	mdata->offset = uaddr & ~PAGE_MASK;

	mdata->offset = uaddr & ~PAGE_MASK;

	mdata->page_order = 0;

	STbp->mapped_pages = pages;

	STbp->mapped_pages = pages;





	return nr_pages;

	return nr_pages;

drivers/scsi/st.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -46,6 +46,7 @@ struct st_buffer { 
	struct st_request *last_SRpnt;

	struct st_request *last_SRpnt;

	struct st_cmdstatus cmdstat;

	struct st_cmdstatus cmdstat;

	struct page **reserved_pages;

	struct page **reserved_pages;

	int reserved_page_order;

	struct page **mapped_pages;

	struct page **mapped_pages;

	struct rq_map_data map_data;

	struct rq_map_data map_data;

	unsigned char *b_data;

	unsigned char *b_data;