diff options
| author | Christof Schmitt <christof.schmitt@de.ibm.com> | 2009-09-17 09:10:14 +0200 |
|---|---|---|
| committer | James Bottomley <James.Bottomley@suse.de> | 2009-10-02 09:45:58 -0500 |
| commit | e27168f8c337b12b8aa8d59c3123c79d2f83603d (patch) | |
| tree | 947d5e483ca1d4ee0bbbbdc7abf317f1f591dbd0 /drivers/scsi/scsi_error.c | |
| parent | 5915136d4d3954867cced8a2297bddd16caf36a1 (diff) | |
| download | op-kernel-dev-e27168f8c337b12b8aa8d59c3123c79d2f83603d.zip op-kernel-dev-e27168f8c337b12b8aa8d59c3123c79d2f83603d.tar.gz | |
[SCSI] sg: Free data buffers after calling blk_rq_unmap_user
Running sg_luns on s390x with CONFIG_DEBUG_PAGEALLOC enabled fails
with EFAULT from the SG_IO ioctl. The EFAULT is the result from
copy_to_user failing in this call chain:
sg_ioctl
sg_new_read
sg_finish_rem_req
blk_rq_unmap_user
__blk_rq_unmap_user
bio_uncopy_user
__bio_copy_iov
copy_to_user
The sg driver calls sg_remove_scat to free the memory pages before
calling blk_rq_unmap_user that tries to copy the data back to
userspace. Change the order to first call blk_rq_unmap_user before
freeing the pages in sg_remove_scat.
Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: stable@kernel.org
Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Diffstat (limited to 'drivers/scsi/scsi_error.c')
0 files changed, 0 insertions, 0 deletions
