summaryrefslogtreecommitdiff
path: root/drivers/scsi/scsi_debug.c
diff options
context:
space:
mode:
authorAkinobu Mita <akinobu.mita@gmail.com>2013-06-29 17:59:14 +0900
committerJames Bottomley <JBottomley@Parallels.com>2013-07-09 09:17:50 +0100
commit518d9df87105a078984c90c75cf6e7f67e3c928c (patch)
tree1563e4e42d9c51e6b33e0c4bf5d171dc35e061ad /drivers/scsi/scsi_debug.c
parente9ce9c86c28c5d44dc408ffe5069597cbbe4663a (diff)
[SCSI] scsi_debug: fix invalid address passed to kunmap_atomic()
In the function prot_verify_write(), the kmap address 'daddr' is incremented in the loop for each data page. Finally 'daddr' reaches the next page boundary in the end of the loop, and the invalid address is passed to kunmap_atomic(). Fix the issue by not incrementing 'daddr' in the loop and offsetting it by the loop counter on demand. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Acked-by: "Martin K. Petersen" <martin.petersen@oracle.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi/scsi_debug.c')
-rw-r--r--drivers/scsi/scsi_debug.c13
1 files changed, 6 insertions, 7 deletions
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 0a537a0515ca..d51bddde5b1f 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1899,7 +1899,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
daddr = kmap_atomic(sg_page(dsgl)) + dsgl->offset;
/* For each sector-sized chunk in data page */
- for (j = 0 ; j < dsgl->length ; j += scsi_debug_sector_size) {
+ for (j = 0; j < dsgl->length; j += scsi_debug_sector_size) {
/* If we're at the end of the current
* protection page advance to the next one
@@ -1917,11 +1917,11 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
switch (scsi_debug_guard) {
case 1:
- csum = ip_compute_csum(daddr,
+ csum = ip_compute_csum(daddr + j,
scsi_debug_sector_size);
break;
case 0:
- csum = cpu_to_be16(crc_t10dif(daddr,
+ csum = cpu_to_be16(crc_t10dif(daddr + j,
scsi_debug_sector_size));
break;
default:
@@ -1938,7 +1938,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
be16_to_cpu(sdt->guard_tag),
be16_to_cpu(csum));
ret = 0x01;
- dump_sector(daddr, scsi_debug_sector_size);
+ dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@@ -1949,7 +1949,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
"%s: REF check failed on sector %lu\n",
__func__, (unsigned long)sector);
ret = 0x03;
- dump_sector(daddr, scsi_debug_sector_size);
+ dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@@ -1959,7 +1959,7 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
"%s: REF check failed on sector %lu\n",
__func__, (unsigned long)sector);
ret = 0x03;
- dump_sector(daddr, scsi_debug_sector_size);
+ dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@@ -1977,7 +1977,6 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
start_sec++;
ei_lba++;
- daddr += scsi_debug_sector_size;
ppage_offset += sizeof(struct sd_dif_tuple);
}