diff options
| author | Rusty Russell <rusty@rustcorp.com.au> | 2007-11-19 11:28:48 +1100 |
|---|---|---|
| committer | James Bottomley <James.Bottomley@HansenPartnership.com> | 2008-01-11 18:22:50 -0600 |
| commit | 4a03d90e35bc5273d27301fa669d4b2103196f94 (patch) | |
| tree | a2ce1aa93b63ed3b8ac1adf9bd696f57fbf3c8ca /drivers | |
| parent | a8aae4d3427a5cf7c92b50125e35ea6cb9ba7394 (diff) | |
[SCSI] BUG_ON() impossible condition in sg list counting
If blk_rq_map_sg wrote more than was allocated in the scatterlist,
BUG_ON() is probably the right thing to do.
[jejb: rejections fixed up]
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Acked-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/scsi/scsi_lib.c | 15 | ||||
| -rw-r--r-- | drivers/scsi/scsi_tgt_lib.c | 11 |
2 files changed, 6 insertions, 20 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index b0c59ae63a2..aa17e718666 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c @@ -1104,7 +1104,6 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes) * * Returns: 0 on success * BLKPREP_DEFER if the failure is retryable - * BLKPREP_KILL if the failure is fatal */ static int scsi_init_io(struct scsi_cmnd *cmd) { @@ -1138,17 +1137,9 @@ static int scsi_init_io(struct scsi_cmnd *cmd) * each segment. */ count = blk_rq_map_sg(req->q, req, cmd->request_buffer); - if (likely(count <= cmd->use_sg)) { - cmd->use_sg = count; - return BLKPREP_OK; - } - - printk(KERN_ERR "Incorrect number of segments after building list\n"); - printk(KERN_ERR "counted %d, received %d\n", count, cmd->use_sg); - printk(KERN_ERR "req nr_sec %lu, cur_nr_sec %u\n", req->nr_sectors, - req->current_nr_sectors); - - return BLKPREP_KILL; + BUG_ON(count > cmd->use_sg); + cmd->use_sg = count; + return BLKPREP_OK; } static struct scsi_cmnd *scsi_get_cmd_from_req(struct scsi_device *sdev, diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c index 241815e911e..93ece8f4e5d 100644 --- a/drivers/scsi/scsi_tgt_lib.c +++ b/drivers/scsi/scsi_tgt_lib.c @@ -368,14 +368,9 @@ static int scsi_tgt_init_cmd(struct scsi_cmnd *cmd, gfp_t gfp_mask) dprintk("cmd %p cnt %d %lu\n", cmd, scsi_sg_count(cmd), rq_data_dir(rq)); count = blk_rq_map_sg(rq->q, rq, scsi_sglist(cmd)); - if (likely(count <= scsi_sg_count(cmd))) { - cmd->use_sg = count; - return 0; - } - - eprintk("cmd %p cnt %d\n", cmd, scsi_sg_count(cmd)); - scsi_free_sgtable(cmd); - return -EINVAL; + BUG_ON(count > cmd->use_sg); + cmd->use_sg = count; + return 0; } /* TODO: test this crap and replace bio_map_user with new interface maybe */ |