lkml.org 
[lkml]   [2015]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.16.y-ckt 134/180] target/file: Fix BUG() when CONFIG_DEBUG_SG=y and DIF protection enabled
    Date
    3.16.7-ckt11 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Akinobu Mita <akinobu.mita@gmail.com>

    commit 38da0f49e8aa1649af397d53f88e163d0e60c058 upstream.

    When CONFIG_DEBUG_SG=y and DIF protection support enabled, kernel
    BUG()s are triggered due to the following two issues:

    1) prot_sg is not initialized by sg_init_table().

    When CONFIG_DEBUG_SG=y, scatterlist helpers check sg entry has a
    correct magic value.

    2) vmalloc'ed buffer is passed to sg_set_buf().

    sg_set_buf() uses virt_to_page() to convert virtual address to struct
    page, but it doesn't work with vmalloc address. vmalloc_to_page()
    should be used instead. As prot_buf isn't usually too large, so
    fix it by allocating prot_buf by kmalloc instead of vmalloc.

    Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
    Cc: Sagi Grimberg <sagig@mellanox.com>
    Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    drivers/target/target_core_file.c | 15 ++++++++-------
    1 file changed, 8 insertions(+), 7 deletions(-)

    diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
    index 6f9f0c499813..e031ea8895e5 100644
    --- a/drivers/target/target_core_file.c
    +++ b/drivers/target/target_core_file.c
    @@ -273,7 +273,7 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot,
    se_dev->prot_length;

    if (!is_write) {
    - fd_prot->prot_buf = vzalloc(prot_size);
    + fd_prot->prot_buf = kzalloc(prot_size, GFP_KERNEL);
    if (!fd_prot->prot_buf) {
    pr_err("Unable to allocate fd_prot->prot_buf\n");
    return -ENOMEM;
    @@ -285,9 +285,10 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot,
    fd_prot->prot_sg_nents, GFP_KERNEL);
    if (!fd_prot->prot_sg) {
    pr_err("Unable to allocate fd_prot->prot_sg\n");
    - vfree(fd_prot->prot_buf);
    + kfree(fd_prot->prot_buf);
    return -ENOMEM;
    }
    + sg_init_table(fd_prot->prot_sg, fd_prot->prot_sg_nents);
    size = prot_size;

    for_each_sg(fd_prot->prot_sg, sg, fd_prot->prot_sg_nents, i) {
    @@ -317,7 +318,7 @@ static int fd_do_prot_rw(struct se_cmd *cmd, struct fd_prot *fd_prot,

    if (is_write || ret < 0) {
    kfree(fd_prot->prot_sg);
    - vfree(fd_prot->prot_buf);
    + kfree(fd_prot->prot_buf);
    }

    return ret;
    @@ -652,11 +653,11 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
    0, fd_prot.prot_sg, 0);
    if (rc) {
    kfree(fd_prot.prot_sg);
    - vfree(fd_prot.prot_buf);
    + kfree(fd_prot.prot_buf);
    return rc;
    }
    kfree(fd_prot.prot_sg);
    - vfree(fd_prot.prot_buf);
    + kfree(fd_prot.prot_buf);
    }
    } else {
    memset(&fd_prot, 0, sizeof(struct fd_prot));
    @@ -672,7 +673,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
    0, fd_prot.prot_sg, 0);
    if (rc) {
    kfree(fd_prot.prot_sg);
    - vfree(fd_prot.prot_buf);
    + kfree(fd_prot.prot_buf);
    return rc;
    }
    }
    @@ -703,7 +704,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,

    if (ret < 0) {
    kfree(fd_prot.prot_sg);
    - vfree(fd_prot.prot_buf);
    + kfree(fd_prot.prot_buf);
    return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
    }


    \
     
     \ /
      Last update: 2015-05-07 12:41    [W:2.720 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site