The 'response' buffer from bsg is mapped onto the SCSI sense buffer, however after commit 82ed4db499b8 we need to allocate them ourselves as the bsg queue is _not_ a SCSI queue, and hence the sense buffer won't be allocated from the scsi stack. Fixes: 82ed4db499b8 ("block: split scsi_request out of struct request") Signed-off-by: Hannes Reinecke <hare@xxxxxxxx> --- block/bsg.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/block/bsg.c b/block/bsg.c index 50e5f8f666f2..7554901096c8 100644 --- a/block/bsg.c +++ b/block/bsg.c @@ -81,6 +81,13 @@ static int bsg_scsi_fill_hdr(struct request *rq, struct sg_io_v4 *hdr, return -ENOMEM; } + if (hdr->response) { + sreq->sense = kzalloc(hdr->max_response_len, GFP_KERNEL); + if (!sreq->sense) + return -ENOMEM; + } else + sreq->sense = NULL; + if (copy_from_user(sreq->cmd, uptr64(hdr->request), sreq->cmd_len)) return -EFAULT; if (blk_verify_command(sreq->cmd, mode)) @@ -128,7 +135,10 @@ static int bsg_scsi_complete_rq(struct request *rq, struct sg_io_v4 *hdr) static void bsg_scsi_free_rq(struct request *rq) { - scsi_req_free_cmd(scsi_req(rq)); + struct scsi_request *sreq = scsi_req(rq); + + kfree(sreq->sense); + scsi_req_free_cmd(sreq); } static const struct bsg_ops bsg_scsi_ops = { -- 2.16.4