projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 55a56237 GKH |
1 | From 8cd79f24350826b81e16990d9e12bc878e67d385 Mon Sep 17 00:00:00 2001 |
| 2 | From: Nicholas Bellinger <nab@linux-iscsi.org> | |
| 3 | Date: Mon, 24 Oct 2011 13:35:37 -0700 | |
| 4 | Subject: tcm_loop: Add explict read buffer memset for SCF_SCSI_CONTROL_SG_IO_CDB | |
| 5 | ||
| 6 | From: Nicholas Bellinger <nab@linux-iscsi.org> | |
| 7 | ||
| 8 | commit 8cd79f24350826b81e16990d9e12bc878e67d385 upstream. | |
| 9 | ||
| 10 | This patch addresses an issue with buggy userspace code sending I/O | |
| 11 | via scsi-generic that does not explictly clear their associated read | |
| 12 | buffers. It adds an explict memset of the first SGL entry within | |
| 13 | tcm_loop_new_cmd_map() for SCF_SCSI_CONTROL_SG_IO_CDB payloads that | |
| 14 | are currently guaranteed to be a single SGL by target-core code. | |
| 15 | ||
| 16 | This issue is a side effect of the v3.1-rc1 merge to remove the | |
| 17 | extra memcpy between certain control CDB types using a contigious | |
| 18 | + cleared buffer in target-core, and performing a memcpy into the | |
| 19 | SGL list within tcm_loop. | |
| 20 | ||
| 21 | It was originally mainfesting itself by udev + scsi_id + scsi-generic | |
| 22 | not properly setting up the expected /dev/disk/by-id/ symlinks because | |
| 23 | the INQUIRY payload was containing extra bogus data preventing the | |
| 24 | proper NAA IEEE WWN from being parsed by userspace. | |
| 25 | ||
| 26 | Cc: Christoph Hellwig <hch@lst.de> | |
| 27 | Cc: Andy Grover <agrover@redhat.com> | |
| 28 | Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> | |
| 29 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
| 30 | ||
| 31 | --- | |
| 32 | drivers/target/loopback/tcm_loop.c | 18 ++++++++++++++++++ | |
| 33 | 1 file changed, 18 insertions(+) | |
| 34 | ||
| 35 | --- a/drivers/target/loopback/tcm_loop.c | |
| 36 | +++ b/drivers/target/loopback/tcm_loop.c | |
| 37 | @@ -174,6 +174,24 @@ static int tcm_loop_new_cmd_map(struct s | |
| 38 | sgl_bidi = sdb->table.sgl; | |
| 39 | sgl_bidi_count = sdb->table.nents; | |
| 40 | } | |
| 41 | + /* | |
| 42 | + * Because some userspace code via scsi-generic do not memset their | |
| 43 | + * associated read buffers, go ahead and do that here for type | |
| 44 | + * SCF_SCSI_CONTROL_SG_IO_CDB. Also note that this is currently | |
| 45 | + * guaranteed to be a single SGL for SCF_SCSI_CONTROL_SG_IO_CDB | |
| 46 | + * by target core in transport_generic_allocate_tasks() -> | |
| 47 | + * transport_generic_cmd_sequencer(). | |
| 48 | + */ | |
| 49 | + if (se_cmd->se_cmd_flags & SCF_SCSI_CONTROL_SG_IO_CDB && | |
| 50 | + se_cmd->data_direction == DMA_FROM_DEVICE) { | |
| 51 | + struct scatterlist *sg = scsi_sglist(sc); | |
| 52 | + unsigned char *buf = kmap(sg_page(sg)) + sg->offset; | |
| 53 | + | |
| 54 | + if (buf != NULL) { | |
| 55 | + memset(buf, 0, sg->length); | |
| 56 | + kunmap(sg_page(sg)); | |
| 57 | + } | |
| 58 | + } | |
| 59 | ||
| 60 | /* Tell the core about our preallocated memory */ | |
| 61 | ret = transport_generic_map_mem_to_cmd(se_cmd, scsi_sglist(sc), |