linux-kernel - RE: [PATCH 5/7] scsi: storvsc: Fix a bug in copy_from_bounce_buffer()

Open Source and information security mailing list archives

Message-ID: <BLUPR03MB4072A440762751DBDA54808CE0D0@BLUPR03MB407.namprd03.prod.outlook.com>
Date:	Mon, 23 Mar 2015 20:52:44 +0000
From:	Long Li <longli@...rosoft.com>
To:	KY Srinivasan <kys@...rosoft.com>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"devel@...uxdriverproject.org" <devel@...uxdriverproject.org>,
	"ohering@...e.com" <ohering@...e.com>,
	"jbottomley@...allels.com" <jbottomley@...allels.com>,
	"hch@...radead.org" <hch@...radead.org>,
	"linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
	"apw@...onical.com" <apw@...onical.com>,
	"vkuznets@...hat.com" <vkuznets@...hat.com>,
	"jasowang@...hat.com" <jasowang@...hat.com>
CC:	"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH 5/7] scsi: storvsc: Fix a bug in copy_from_bounce_buffer()


> -----Original Message-----
> From: devel [mailto:driverdev-devel-bounces@...uxdriverproject.org] On
> Behalf Of K. Y. Srinivasan
> Sent: Monday, March 23, 2015 2:07 PM
> To: gregkh@...uxfoundation.org; linux-kernel@...r.kernel.org;
> devel@...uxdriverproject.org; ohering@...e.com; jbottomley@...allels.com;
> hch@...radead.org; linux-scsi@...r.kernel.org; apw@...onical.com;
> vkuznets@...hat.com; jasowang@...hat.com
> Cc: stable@...r.kernel.org
> Subject: [PATCH 5/7] scsi: storvsc: Fix a bug in copy_from_bounce_buffer()
> 
> We may exit this function without properly freeing up the maapings we may
> have acquired. Fix the bug.
> 
> Signed-off-by: K. Y. Srinivasan <kys@...rosoft.com>
Reviewed-by: Long Li <longli@...rosoft.com>

> Cc: <stable@...r.kernel.org>
> ---
>  drivers/scsi/storvsc_drv.c |   15 ++++++++-------
>  1 files changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index
> 5c13eec..88f5d79 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
> @@ -754,21 +754,22 @@ static unsigned int copy_to_bounce_buffer(struct
> scatterlist *orig_sgl,
>  			if (bounce_sgl[j].length == PAGE_SIZE) {
>  				/* full..move to next entry */
>  				sg_kunmap_atomic(bounce_addr);
> +				bounce_addr = 0;
>  				j++;
> +			}
> 
> -				/* if we need to use another bounce buffer */
> -				if (srclen || i != orig_sgl_count - 1)
> -					bounce_addr =
> sg_kmap_atomic(bounce_sgl,j);
> +			/* if we need to use another bounce buffer */
> +			if (srclen && bounce_addr == 0)
> +				bounce_addr = sg_kmap_atomic(bounce_sgl,
> j);
> 
> -			} else if (srclen == 0 && i == orig_sgl_count - 1) {
> -				/* unmap the last bounce that is < PAGE_SIZE
> */
> -				sg_kunmap_atomic(bounce_addr);
> -			}
>  		}
> 
>  		sg_kunmap_atomic(src_addr - orig_sgl[i].offset);
>  	}
> 
> +	if (bounce_addr)
> +		sg_kunmap_atomic(bounce_addr);
> +
>  	local_irq_restore(flags);
> 
>  	return total_copied;
> --
> 1.7.4.1
> 
> _______________________________________________
> devel mailing list
> devel@...uxdriverproject.org
> http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives