[SCSI] scsi_debug: fix invalid address passed to kunmap_atomic()
In the function prot_verify_write(), the kmap address 'daddr' is
incremented in the loop for each data page. Finally 'daddr' reaches
the next page boundary in the end of the loop, and the invalid address
is passed to kunmap_atomic().
Fix the issue by not incrementing 'daddr' in the loop and offsetting it
by the loop counter on demand.
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Acked-by: "Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 0a537a0..d51bddd 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1899,7 +1899,7 @@
daddr = kmap_atomic(sg_page(dsgl)) + dsgl->offset;
/* For each sector-sized chunk in data page */
- for (j = 0 ; j < dsgl->length ; j += scsi_debug_sector_size) {
+ for (j = 0; j < dsgl->length; j += scsi_debug_sector_size) {
/* If we're at the end of the current
* protection page advance to the next one
@@ -1917,11 +1917,11 @@
switch (scsi_debug_guard) {
case 1:
- csum = ip_compute_csum(daddr,
+ csum = ip_compute_csum(daddr + j,
scsi_debug_sector_size);
break;
case 0:
- csum = cpu_to_be16(crc_t10dif(daddr,
+ csum = cpu_to_be16(crc_t10dif(daddr + j,
scsi_debug_sector_size));
break;
default:
@@ -1938,7 +1938,7 @@
be16_to_cpu(sdt->guard_tag),
be16_to_cpu(csum));
ret = 0x01;
- dump_sector(daddr, scsi_debug_sector_size);
+ dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@@ -1949,7 +1949,7 @@
"%s: REF check failed on sector %lu\n",
__func__, (unsigned long)sector);
ret = 0x03;
- dump_sector(daddr, scsi_debug_sector_size);
+ dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@@ -1959,7 +1959,7 @@
"%s: REF check failed on sector %lu\n",
__func__, (unsigned long)sector);
ret = 0x03;
- dump_sector(daddr, scsi_debug_sector_size);
+ dump_sector(daddr + j, scsi_debug_sector_size);
goto out;
}
@@ -1977,7 +1977,6 @@
start_sec++;
ei_lba++;
- daddr += scsi_debug_sector_size;
ppage_offset += sizeof(struct sd_dif_tuple);
}