Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e623ddb4 authored by FUJITA Tomonori's avatar FUJITA Tomonori Committed by James Bottomley
Browse files

[SCSI] block: fix bio_add_page misuse with rq_map_data 



This fixes bio_add_page misuse in bio_copy_user_iov with rq_map_data,
which only sg uses now.

rq_map_data carries page frames for bio_add_pc_page. bio_copy_user_iov
uses bio_add_pc_page with a larger size than PAGE_SIZE. It's clearly
wrong.

Signed-off-by: default avatarFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: default avatarJens Axboe <jens.axboe@oracle.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
parent 4f10aae0

fs/bio.c

+14 −12
Original line number Diff line number Diff line
@@ -815,29 +815,31 @@ struct bio *bio_copy_user_iov(struct request_queue *q, 


	ret = 0;

	i = 0;

	while (len) {

		unsigned int bytes;



	if (map_data)

			bytes = 1U << (PAGE_SHIFT + map_data->page_order);

		else

			bytes = PAGE_SIZE;

		nr_pages = 1 << map_data->page_order;

	while (len) {

		unsigned int bytes = PAGE_SIZE;



		if (bytes > len)

			bytes = len;



		if (map_data) {

			if (i == map_data->nr_entries) {

			if (i == map_data->nr_entries * nr_pages) {

				ret = -ENOMEM;

				break;

			}

			page = map_data->pages[i++];

		} else



			page = map_data->pages[i / nr_pages];

			page += (i % nr_pages);



			i++;

		} else {

			page = alloc_page(q->bounce_gfp | gfp_mask);

			if (!page) {

				ret = -ENOMEM;

				break;

			}

		}



		if (bio_add_pc_page(q, bio, page, bytes, 0) < bytes)

			break;