Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: > Is it actually known to be broken on 64-bit, or does it happen to work? It's casting a 32-bit value to a userspace pointer and then passing that to copy_to/from_user(): // TODO 64bit fix if (copy_from_user (p->virt, (void __user *)(unsigned long)sg[i]. addr_bus, sg_size)) { and: // TODO 64bit fix if (copy_to_user ((void __user *)sg[j].addr_bus, sg_list[j], sg_size)) { so someone's obviously aware that it is wrong. According to vc-annotate it's been there since before Linus last reset the history, so obviously someone's aware of it. Another of these has in fact been cast in the way Linus objects to: // TODO 64bit fix if (copy_to_user ((void __user *)(u64) sg[j].addr_bus, sg_list[j].virt, sg_size)) { The problem, I suspect, is that userspace may have addresses that can't be held in the 32-bit addr_bus value, but the 32-bit value is held in the i2o_message struct: static int i2o_cfg_passthru(unsigned long arg) { ... struct i2o_message *msg; ... // TODO 64bit fix sg = (struct sg_simple_element *)((&msg->u.head[0]) + sg_offset); ... } and if these i2o_message structs are actually passed to the hardware, it may not be possible to actually expand them, and looking at i2o_msg_post(), that seems to be exactly what happens. David -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html