From: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
This patch fixes a bug in iscsit_allocate_iovecs() where iov_count was
incorrectly calculated using min(1UL, data_length / PAGE_SIZE) instead of
max(1UL, data_length / PAGE_SIZE), that ends up triggering an OOPs for
large block I/O when the SGL <-> iovec mapping exceeds the bogus iov_count
allocation size.
This is a regression introduced during the iscsi-target conversion back
to using core memory allocation here:
commit e03470f98341a61bb31c8655e83b11f6f4934499
Author: Andy Grover <agrover@xxxxxxxxxx>
Date: Tue Apr 3 15:51:29 2012 -0700
target/iscsi: Go back to core allocating data buffer for cmd
Cc: Andy Grover <agrover@xxxxxxxxxx>
Signed-off-by: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
---
drivers/target/iscsi/iscsi_target.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index e399471..d57d10c 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -760,7 +760,7 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
static int iscsit_allocate_iovecs(struct iscsi_cmd *cmd)
{
- u32 iov_count = min(1UL, DIV_ROUND_UP(cmd->se_cmd.data_length, PAGE_SIZE));
+ u32 iov_count = max(1UL, DIV_ROUND_UP(cmd->se_cmd.data_length, PAGE_SIZE));
iov_count += ISCSI_IOV_DATA_BUFFER;
--
1.7.2.5
--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
