[3.16.y-ckt stable] Patch "scsi: storvsc: Fix a bug in copy_from_bounce_buffer()" has been added to staging queue

Luis Henriques luis.henriques at canonical.com
Wed May 6 09:50:57 UTC 2015


This is a note to let you know that I have just added a patch titled

    scsi: storvsc: Fix a bug in copy_from_bounce_buffer()

to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-queue

This patch is scheduled to be released in version 3.16.7-ckt11.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From 9eee60ef30e3c33a1e7b988fbf24aeaa797ac16d Mon Sep 17 00:00:00 2001
From: "K. Y. Srinivasan" <kys at microsoft.com>
Date: Fri, 27 Mar 2015 00:27:18 -0700
Subject: scsi: storvsc: Fix a bug in copy_from_bounce_buffer()

commit 8de580742fee8bc34d116f57a20b22b9a5f08403 upstream.

We may exit this function without properly freeing up the maapings
we may have acquired. Fix the bug.

Signed-off-by: K. Y. Srinivasan <kys at microsoft.com>
Reviewed-by: Long Li <longli at microsoft.com>
Signed-off-by: James Bottomley <JBottomley at Odin.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 drivers/scsi/storvsc_drv.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 86b05151fdab..97892f258043 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -739,21 +739,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
 			if (bounce_sgl[j].length == PAGE_SIZE) {
 				/* full..move to next entry */
 				sg_kunmap_atomic(bounce_addr);
+				bounce_addr = 0;
 				j++;
+			}

-				/* if we need to use another bounce buffer */
-				if (srclen || i != orig_sgl_count - 1)
-					bounce_addr = sg_kmap_atomic(bounce_sgl,j);
+			/* if we need to use another bounce buffer */
+			if (srclen && bounce_addr == 0)
+				bounce_addr = sg_kmap_atomic(bounce_sgl, j);

-			} else if (srclen == 0 && i == orig_sgl_count - 1) {
-				/* unmap the last bounce that is < PAGE_SIZE */
-				sg_kunmap_atomic(bounce_addr);
-			}
 		}

 		sg_kunmap_atomic(src_addr - orig_sgl[i].offset);
 	}

+	if (bounce_addr)
+		sg_kunmap_atomic(bounce_addr);
+
 	local_irq_restore(flags);

 	return total_copied;




More information about the kernel-team mailing list