]>
Commit | Line | Data |
---|---|---|
eefdbb8e GKH |
1 | From 8de580742fee8bc34d116f57a20b22b9a5f08403 Mon Sep 17 00:00:00 2001 |
2 | From: "K. Y. Srinivasan" <kys@microsoft.com> | |
3 | Date: Fri, 27 Mar 2015 00:27:18 -0700 | |
4 | Subject: scsi: storvsc: Fix a bug in copy_from_bounce_buffer() | |
5 | ||
6 | From: "K. Y. Srinivasan" <kys@microsoft.com> | |
7 | ||
8 | commit 8de580742fee8bc34d116f57a20b22b9a5f08403 upstream. | |
9 | ||
10 | We may exit this function without properly freeing up the maapings | |
11 | we may have acquired. Fix the bug. | |
12 | ||
13 | Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> | |
14 | Reviewed-by: Long Li <longli@microsoft.com> | |
15 | Signed-off-by: James Bottomley <JBottomley@Odin.com> | |
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
17 | ||
18 | --- | |
19 | drivers/scsi/storvsc_drv.c | 15 ++++++++------- | |
20 | 1 file changed, 8 insertions(+), 7 deletions(-) | |
21 | ||
22 | --- a/drivers/scsi/storvsc_drv.c | |
23 | +++ b/drivers/scsi/storvsc_drv.c | |
24 | @@ -741,21 +741,22 @@ static unsigned int copy_to_bounce_buffe | |
25 | if (bounce_sgl[j].length == PAGE_SIZE) { | |
26 | /* full..move to next entry */ | |
27 | sg_kunmap_atomic(bounce_addr); | |
28 | + bounce_addr = 0; | |
29 | j++; | |
30 | + } | |
31 | ||
32 | - /* if we need to use another bounce buffer */ | |
33 | - if (srclen || i != orig_sgl_count - 1) | |
34 | - bounce_addr = sg_kmap_atomic(bounce_sgl,j); | |
35 | + /* if we need to use another bounce buffer */ | |
36 | + if (srclen && bounce_addr == 0) | |
37 | + bounce_addr = sg_kmap_atomic(bounce_sgl, j); | |
38 | ||
39 | - } else if (srclen == 0 && i == orig_sgl_count - 1) { | |
40 | - /* unmap the last bounce that is < PAGE_SIZE */ | |
41 | - sg_kunmap_atomic(bounce_addr); | |
42 | - } | |
43 | } | |
44 | ||
45 | sg_kunmap_atomic(src_addr - orig_sgl[i].offset); | |
46 | } | |
47 | ||
48 | + if (bounce_addr) | |
49 | + sg_kunmap_atomic(bounce_addr); | |
50 | + | |
51 | local_irq_restore(flags); | |
52 | ||
53 | return total_copied; |