diff options
| author | Asias He <asias@redhat.com> | 2013-03-19 05:55:16 +0100 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2013-03-20 01:31:14 +0100 |
| commit | 8f27d487bcc2bd603c2d87e1729abcbc301f15db (patch) | |
| tree | 64ee7f44b5347c096cac35dcf0f1485707303f8c /drivers/target | |
| parent | target/file: Bump FD_MAX_SECTORS to 2048 to handle 1M sized I/Os (diff) | |
| download | linux-8f27d487bcc2bd603c2d87e1729abcbc301f15db.tar.xz linux-8f27d487bcc2bd603c2d87e1729abcbc301f15db.zip | |
target/pscsi: Reject cross page boundary case in pscsi_map_sg
We can only have one page of data in each sg element, so we can not
cross a page boundary. Fail this case.
The 'while (len > 0 && data_len > 0) {}' loop is not necessary. The loop
can only be executed once.
Signed-off-by: Asias He <asias@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target')
| -rw-r--r-- | drivers/target/target_core_pscsi.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c index 82e78d72fdb6..e992b27aa090 100644 --- a/drivers/target/target_core_pscsi.c +++ b/drivers/target/target_core_pscsi.c @@ -883,7 +883,14 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, pr_debug("PSCSI: i: %d page: %p len: %d off: %d\n", i, page, len, off); - while (len > 0 && data_len > 0) { + /* + * We only have one page of data in each sg element, + * we can not cross a page boundary. + */ + if (off + len > PAGE_SIZE) + goto fail; + + if (len > 0 && data_len > 0) { bytes = min_t(unsigned int, len, PAGE_SIZE - off); bytes = min(bytes, data_len); @@ -940,9 +947,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, bio = NULL; } - len -= bytes; data_len -= bytes; - off = 0; } } |