Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a03d90e authored by Rusty Russell's avatar Rusty Russell Committed by James Bottomley
Browse files

[SCSI] BUG_ON() impossible condition in sg list counting 



If blk_rq_map_sg wrote more than was allocated in the scatterlist,
BUG_ON() is probably the right thing to do.

[jejb: rejections fixed up]

Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
Acked-by: default avatarJens Axboe <jens.axboe@oracle.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@HansenPartnership.com>
parent a8aae4d3

drivers/scsi/scsi_lib.c

+3 −12
Original line number Original line Diff line number Diff line
@@ -1104,7 +1104,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes) 
 *

 *

 * Returns:     0 on success

 * Returns:     0 on success

 *		BLKPREP_DEFER if the failure is retryable

 *		BLKPREP_DEFER if the failure is retryable

 *		BLKPREP_KILL if the failure is fatal

 */

 */

static int scsi_init_io(struct scsi_cmnd *cmd)

static int scsi_init_io(struct scsi_cmnd *cmd)

{

{
@@ -1138,19 +1137,11 @@ static int scsi_init_io(struct scsi_cmnd *cmd) 
	 * each segment.

	 * each segment.

	 */

	 */

	count = blk_rq_map_sg(req->q, req, cmd->request_buffer);

	count = blk_rq_map_sg(req->q, req, cmd->request_buffer);

	if (likely(count <= cmd->use_sg)) {

	BUG_ON(count > cmd->use_sg);

	cmd->use_sg = count;

	cmd->use_sg = count;

	return BLKPREP_OK;

	return BLKPREP_OK;

}

}





	printk(KERN_ERR "Incorrect number of segments after building list\n");

	printk(KERN_ERR "counted %d, received %d\n", count, cmd->use_sg);

	printk(KERN_ERR "req nr_sec %lu, cur_nr_sec %u\n", req->nr_sectors,

			req->current_nr_sectors);



	return BLKPREP_KILL;

}



static struct scsi_cmnd *scsi_get_cmd_from_req(struct scsi_device *sdev,

static struct scsi_cmnd *scsi_get_cmd_from_req(struct scsi_device *sdev,

		struct request *req)

		struct request *req)

{

{

drivers/scsi/scsi_tgt_lib.c

+3 −8
Original line number Original line Diff line number Diff line
@@ -368,16 +368,11 @@ static int scsi_tgt_init_cmd(struct scsi_cmnd *cmd, gfp_t gfp_mask) 
	dprintk("cmd %p cnt %d %lu\n", cmd, scsi_sg_count(cmd),

	dprintk("cmd %p cnt %d %lu\n", cmd, scsi_sg_count(cmd),

		rq_data_dir(rq));

		rq_data_dir(rq));

	count = blk_rq_map_sg(rq->q, rq, scsi_sglist(cmd));

	count = blk_rq_map_sg(rq->q, rq, scsi_sglist(cmd));

	if (likely(count <= scsi_sg_count(cmd))) {

	BUG_ON(count > cmd->use_sg);

	cmd->use_sg = count;

	cmd->use_sg = count;

	return 0;

	return 0;

}

}





	eprintk("cmd %p cnt %d\n", cmd, scsi_sg_count(cmd));

	scsi_free_sgtable(cmd);

	return -EINVAL;

}



/* TODO: test this crap and replace bio_map_user with new interface maybe */

/* TODO: test this crap and replace bio_map_user with new interface maybe */

static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,

static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,

			       unsigned long uaddr, unsigned int len, int rw)

			       unsigned long uaddr, unsigned int len, int rw)