Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8367778 authored by Akinobu Mita's avatar Akinobu Mita Committed by Nicholas Bellinger
Browse files

target/file: Fix SG table for prot_buf initialization 



In fd_do_prot_rw(), it allocates prot_buf which is used to copy from
se_cmd->t_prot_sg by sbc_dif_copy_prot().  The SG table for prot_buf
is also initialized by allocating 'se_cmd->t_prot_nents' entries of
scatterlist and setting the data length of each entry to PAGE_SIZE
at most.

However if se_cmd->t_prot_sg contains a clustered entry (i.e.
sg->length > PAGE_SIZE), the SG table for prot_buf can't be
initialized correctly and sbc_dif_copy_prot() can't copy to prot_buf.
(This actually happened with TCM loopback fabric module)

As prot_buf is allocated by kzalloc() and it's physically contiguous,
we only need a single scatterlist entry.

Signed-off-by: default avatarAkinobu Mita <akinobu.mita@gmail.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
Cc: <stable@vger.kernel.org> # v3.14+
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 38da0f49

drivers/target/target_core_file.c

+6 −15
Original line number Original line Diff line number Diff line
@@ -264,11 +264,10 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot, 
	struct se_device *se_dev = cmd->se_dev;

	struct se_device *se_dev = cmd->se_dev;

	struct fd_dev *dev = FD_DEV(se_dev);

	struct fd_dev *dev = FD_DEV(se_dev);

	struct file *prot_fd = dev->fd_prot_file;

	struct file *prot_fd = dev->fd_prot_file;

	struct scatterlist *sg;

	loff_t pos = (cmd->t_task_lba * se_dev->prot_length);

	loff_t pos = (cmd->t_task_lba * se_dev->prot_length);

	unsigned char *buf;

	unsigned char *buf;

	u32 prot_size, len, size;

	u32 prot_size;

	int rc, ret = 1, i;

	int rc, ret = 1;





	prot_size = (cmd->data_length / se_dev->dev_attrib.block_size) *

	prot_size = (cmd->data_length / se_dev->dev_attrib.block_size) *

		     se_dev->prot_length;

		     se_dev->prot_length;
@@ -281,24 +280,16 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot, 
		}

		}

		buf = fd_prot->prot_buf;

		buf = fd_prot->prot_buf;





		fd_prot->prot_sg_nents = cmd->t_prot_nents;

		fd_prot->prot_sg_nents = 1;

		fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist) *

		fd_prot->prot_sg = kzalloc(sizeof(struct scatterlist),

					   fd_prot->prot_sg_nents, GFP_KERNEL);

					   GFP_KERNEL);

		if (!fd_prot->prot_sg) {

		if (!fd_prot->prot_sg) {

			pr_err("Unable to allocate fd_prot->prot_sg\n");

			pr_err("Unable to allocate fd_prot->prot_sg\n");

			kfree(fd_prot->prot_buf);

			kfree(fd_prot->prot_buf);

			return -ENOMEM;

			return -ENOMEM;

		}

		}

		sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents);

		sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents);

		size = prot_size;

		sg_set_buf(fd_prot->prot_sg, buf, prot_size);



		for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) {



			len = min_t(u32, PAGE_SIZE, size);

			sg_set_buf(sg, buf, len);

			size -= len;

			buf += len;

		}

	}

	}





	if (is_write) {

	if (is_write) {