On 04/06/20 11:31, Ye Bin wrote:
> diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
> index 435781a16875..03dd265c30be 100644
> --- a/drivers/ata/libata-scsi.c
> +++ b/drivers/ata/libata-scsi.c
> @@ -3684,12 +3684,13 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc)
> {
> struct scsi_cmnd *scmd = qc->scsicmd;
> const u8 *cdb = scmd->cmnd;
> - const u8 *p;
> u8 pg, spg;
> unsigned six_byte, pg_len, hdr_len, bd_len;
> int len;
> u16 fp = (u16)-1;
> u8 bp = 0xff;
> + u8 buffer[64];
> + const u8 *p = buffer;
>
> VPRINTK("ENTER\n");
>
> @@ -3723,12 +3724,14 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc)
> if (!scsi_sg_count(scmd) || scsi_sglist(scmd)->length < len)
> goto invalid_param_len;
>
> - p = page_address(sg_page(scsi_sglist(scmd)));
> -
> /* Move past header and block descriptors. */
> if (len < hdr_len)
> goto invalid_param_len;
>
> + if (!sg_copy_to_buffer(scsi_sglist(scmd), scsi_sg_count(scmd),
> + buffer, 64))
sizeof(buffer) would be better. But anyway:
Reviewed-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Perhaps the maintainer can fix it up on commit.
Paolo
> + goto invalid_param_len;
> +
> if (six_byte)
> bd_len = p[3];
> else
>
