aboutsummaryrefslogtreecommitdiff
path: root/drivers/target
diff options
context:
space:
mode:
authorAsias He <asias@redhat.com>2013-03-19 12:55:16 +0800
committerNicholas Bellinger <nab@linux-iscsi.org>2013-03-19 17:31:14 -0700
commit8f27d487bcc2bd603c2d87e1729abcbc301f15db (patch)
tree64ee7f44b5347c096cac35dcf0f1485707303f8c /drivers/target
parentf002a24388cc460c8a9be7d446a9871f7c9d52b6 (diff)
downloadlinux-8f27d487bcc2bd603c2d87e1729abcbc301f15db.tar.gz
target/pscsi: Reject cross page boundary case in pscsi_map_sg
We can only have one page of data in each sg element, so we can not cross a page boundary. Fail this case. The 'while (len > 0 && data_len > 0) {}' loop is not necessary. The loop can only be executed once. Signed-off-by: Asias He <asias@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target')
-rw-r--r--drivers/target/target_core_pscsi.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 82e78d72fdb..e992b27aa09 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -883,7 +883,14 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
pr_debug("PSCSI: i: %d page: %p len: %d off: %d\n", i,
page, len, off);
- while (len > 0 && data_len > 0) {
+ /*
+ * We only have one page of data in each sg element,
+ * we can not cross a page boundary.
+ */
+ if (off + len > PAGE_SIZE)
+ goto fail;
+
+ if (len > 0 && data_len > 0) {
bytes = min_t(unsigned int, len, PAGE_SIZE - off);
bytes = min(bytes, data_len);
@@ -940,9 +947,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
bio = NULL;
}
- len -= bytes;
data_len -= bytes;
- off = 0;
}
}