From: Sameer Wadgaonkar <sameer.wadgaon...@unisys.com>

[ Upstream commit 3c2bf0bd08123f3497bd3e84bd9088c937b0cb40 ]

The root issue is that we are not allowed to have items on the
stack being passed to "DMA" like operations. In this case we have
a vmcall and an inline completion of scsi command.

This patch fixes the issue by moving the variables on stack in
do_scsi_nolinuxstat() to heap memory.

Signed-off-by: Sameer Wadgaonkar <sameer.wadgaon...@unisys.com>
Signed-off-by: David Kershner <david.kersh...@unisys.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.le...@microsoft.com>
---
 drivers/staging/unisys/visorhba/visorhba_main.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/unisys/visorhba/visorhba_main.c 
b/drivers/staging/unisys/visorhba/visorhba_main.c
index 5a7a87efed27..28b5392153a8 100644
--- a/drivers/staging/unisys/visorhba/visorhba_main.c
+++ b/drivers/staging/unisys/visorhba/visorhba_main.c
@@ -842,7 +842,7 @@ static void
 do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd)
 {
        struct scsi_device *scsidev;
-       unsigned char buf[36];
+       unsigned char *buf;
        struct scatterlist *sg;
        unsigned int i;
        char *this_page;
@@ -857,6 +857,10 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct 
scsi_cmnd *scsicmd)
                if (cmdrsp->scsi.no_disk_result == 0)
                        return;
 
+               buf = kzalloc(sizeof(char) * 36, GFP_KERNEL);
+               if (!buf)
+                       return;
+
                /* Linux scsi code wants a device at Lun 0
                 * to issue report luns, but we don't want
                 * a disk there so we'll present a processor
@@ -868,6 +872,7 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct 
scsi_cmnd *scsicmd)
                if (scsi_sg_count(scsicmd) == 0) {
                        memcpy(scsi_sglist(scsicmd), buf,
                               cmdrsp->scsi.bufflen);
+                       kfree(buf);
                        return;
                }
 
@@ -879,6 +884,7 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct 
scsi_cmnd *scsicmd)
                        memcpy(this_page, buf + bufind, sg[i].length);
                        kunmap_atomic(this_page_orig);
                }
+               kfree(buf);
        } else {
                devdata = (struct visorhba_devdata *)scsidev->host->hostdata;
                for_each_vdisk_match(vdisk, devdata, scsidev) {
-- 
2.14.1

Reply via email to