diff options
author | Christof Schmitt <christof.schmitt@de.ibm.com> | 2009-09-17 09:10:14 +0200 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-10-22 15:11:45 -0700 |
commit | c961be555eb557b9e3e8403c0d6573dc432cff5e (patch) | |
tree | d4a9f4b8695d04fbea1088a4ebd7c37d0619ef21 /arch | |
parent | b509b9bd9966e8922bc44e77abe2fea6d8e1c2db (diff) |
SCSI: sg: Free data buffers after calling blk_rq_unmap_user
commit e27168f8c337b12b8aa8d59c3123c79d2f83603d upstream.
Running sg_luns on s390x with CONFIG_DEBUG_PAGEALLOC enabled fails
with EFAULT from the SG_IO ioctl. The EFAULT is the result from
copy_to_user failing in this call chain:
sg_ioctl
sg_new_read
sg_finish_rem_req
blk_rq_unmap_user
__blk_rq_unmap_user
bio_uncopy_user
__bio_copy_iov
copy_to_user
The sg driver calls sg_remove_scat to free the memory pages before
calling blk_rq_unmap_user that tries to copy the data back to
userspace. Change the order to first call blk_rq_unmap_user before
freeing the pages in sg_remove_scat.
Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'arch')
0 files changed, 0 insertions, 0 deletions