This fixes the scsi_dma_map failure path, which could lead to data
corruption.
Signed-off-by: FUJITA Tomonori <fujita.tomonori@xxxxxxxxxxxxx>
---
drivers/block/cciss_scsi.c | 17 +++++++++++++----
1 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 4aca7dd..9d9aa53 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -1185,7 +1185,7 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
dma mapping and fills in the scatter gather entries of the
cciss command, cp. */
-static void
+static int
cciss_scatter_gather(struct pci_dev *pdev,
CommandList_struct *cp,
struct scsi_cmnd *cmd)
@@ -1198,7 +1198,9 @@ cciss_scatter_gather(struct pci_dev *pdev,
BUG_ON(scsi_sg_count(cmd) > MAXSGENTRIES);
use_sg = scsi_dma_map(cmd);
- if (use_sg) { /* not too many addrs? */
+ if (use_sg < 0)
+ return use_sg;
+ else if (use_sg) { /* not too many addrs? */
scsi_for_each_sg(cmd, sg, use_sg, i) {
addr64 = (__u64) sg_dma_address(sg);
len = sg_dma_len(sg);
@@ -1213,7 +1215,7 @@ cciss_scatter_gather(struct pci_dev *pdev,
cp->Header.SGList = (__u8) use_sg; /* no. SGs contig in this cmd */
cp->Header.SGTotal = (__u16) use_sg; /* total sgs in this cmd list */
- return;
+ return 0;
}
@@ -1311,7 +1313,14 @@ cciss_scsi_queue_command (struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd
break;
}
- cciss_scatter_gather((*c)->pdev, cp, cmd); // Fill the SG list
+ rc = cciss_scatter_gather((*c)->pdev, cp, cmd); // Fill the SG list
+ if (rc < 0) {
+ spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
+ scsi_cmd_free(*c, cp);
+ spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
+
+ return SCSI_MLQUEUE_HOST_BUSY;
+ }
/* Put the request on the tail of the request queue */
--
1.5.2.4
-
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
