Reviewed-by: Joonkyo Jung <joonkyoj@yonsei.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
- drivers/nvme/target/tcp.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
+ drivers/nvme/target/tcp.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
-diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
-index 6fd4f74315f6c..a906507bad600 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
-@@ -294,11 +294,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd)
+@@ -294,11 +294,14 @@ static void nvmet_tcp_free_cmd_buffers(s
cmd->req.sg = NULL;
}
int nr_pages;
length = cmd->pdu_len;
-@@ -306,9 +309,22 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+@@ -306,17 +309,32 @@ static void nvmet_tcp_build_pdu_iovec(st
offset = cmd->rbytes_done;
cmd->sg_idx = offset / PAGE_SIZE;
sg_offset = offset % PAGE_SIZE;
+ sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;
while (length) {
+ u32 iov_len = min_t(u32, length, sg->length - sg_offset);
+
+ if (!sg_remaining) {
+ nvmet_tcp_fatal_error(cmd->queue);
+ return;
+ nvmet_tcp_fatal_error(cmd->queue);
+ return;
+ }
- u32 iov_len = min_t(u32, length, sg->length - sg_offset);
-
++
iov->bv_page = sg_page(sg);
-@@ -317,6 +333,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+ iov->bv_len = sg->length;
+ iov->bv_offset = sg->offset + sg_offset;
length -= iov_len;
sg = sg_next(sg);
iov++;
sg_offset = 0;
}
---
-2.51.0
-
Reviewed-by: Joonkyo Jung <joonkyoj@yonsei.ac.kr>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
- drivers/nvme/target/tcp.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
+ drivers/nvme/target/tcp.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
-diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
-index d0fcce6aec93f..9264ce64ed834 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
-@@ -306,11 +306,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd)
+@@ -306,11 +306,14 @@ static void nvmet_tcp_free_cmd_buffers(s
cmd->req.sg = NULL;
}
int nr_pages;
length = cmd->pdu_len;
-@@ -318,9 +321,22 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+@@ -318,17 +321,32 @@ static void nvmet_tcp_build_pdu_iovec(st
offset = cmd->rbytes_done;
cmd->sg_idx = offset / PAGE_SIZE;
sg_offset = offset % PAGE_SIZE;
+ sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;
while (length) {
+ u32 iov_len = min_t(u32, length, sg->length - sg_offset);
+
+ if (!sg_remaining) {
+ nvmet_tcp_fatal_error(cmd->queue);
+ return;
+ nvmet_tcp_fatal_error(cmd->queue);
+ return;
+ }
- u32 iov_len = min_t(u32, length, sg->length - sg_offset);
-
++
iov->bv_page = sg_page(sg);
-@@ -329,6 +345,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+ iov->bv_len = sg->length;
+ iov->bv_offset = sg->offset + sg_offset;
length -= iov_len;
sg = sg_next(sg);
iov++;
sg_offset = 0;
}
---
-2.51.0
-