Hi Asias, On Tue, 2013-03-19 at 12:55 +0800, Asias He wrote: > We can only have one page of data in each sg element, so we can not > cross a page boundary. Fail this case. > > The 'while (len > 0 && data_len > 0) {}' loop is not necessary. The loop > can only be executed once. > > Signed-off-by: Asias He <asias@xxxxxxxxxx> > --- Thanks for adding a check to reject here for this special case. Applied to master w/ with a slightly different subject (s/Handle/Reject) --nab > drivers/target/target_core_pscsi.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c > index 82e78d7..e992b27 100644 > --- a/drivers/target/target_core_pscsi.c > +++ b/drivers/target/target_core_pscsi.c > @@ -883,7 +883,14 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, > pr_debug("PSCSI: i: %d page: %p len: %d off: %d\n", i, > page, len, off); > > - while (len > 0 && data_len > 0) { > + /* > + * We only have one page of data in each sg element, > + * we can not cross a page boundary. > + */ > + if (off + len > PAGE_SIZE) > + goto fail; > + > + if (len > 0 && data_len > 0) { > bytes = min_t(unsigned int, len, PAGE_SIZE - off); > bytes = min(bytes, data_len); > > @@ -940,9 +947,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, > bio = NULL; > } > > - len -= bytes; > data_len -= bytes; > - off = 0; > } > } > -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html