From d2f5fe153111309ae55aa2713e42c23537523072 Mon Sep 17 00:00:00 2001 From: Asias He Date: Tue, 19 Mar 2013 12:55:16 +0800 Subject: [PATCH] --- yaml --- r: 361716 b: refs/heads/master c: 8f27d487bcc2bd603c2d87e1729abcbc301f15db h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/target/target_core_pscsi.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/[refs] b/[refs] index 0220502a24f3..e535e1a9e825 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: f002a24388cc460c8a9be7d446a9871f7c9d52b6 +refs/heads/master: 8f27d487bcc2bd603c2d87e1729abcbc301f15db diff --git a/trunk/drivers/target/target_core_pscsi.c b/trunk/drivers/target/target_core_pscsi.c index 82e78d72fdb6..e992b27aa090 100644 --- a/trunk/drivers/target/target_core_pscsi.c +++ b/trunk/drivers/target/target_core_pscsi.c @@ -883,7 +883,14 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, pr_debug("PSCSI: i: %d page: %p len: %d off: %d\n", i, page, len, off); - while (len > 0 && data_len > 0) { + /* + * We only have one page of data in each sg element, + * we can not cross a page boundary. + */ + if (off + len > PAGE_SIZE) + goto fail; + + if (len > 0 && data_len > 0) { bytes = min_t(unsigned int, len, PAGE_SIZE - off); bytes = min(bytes, data_len); @@ -940,9 +947,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, bio = NULL; } - len -= bytes; data_len -= bytes; - off = 0; } }