kmap_atomic() is now using stack based implementation and doesn't take
the KM_type argument anymore.  So nesting kmap_atomic() calls must be
properly stacked.

This fixes nesting kmap_atomic() calls for scsi_sglist and scsi_prot_sglist
in prot_verify_write().

This also fixes another issue that invalid kmap address is used for
kunmap_atomic(): the kmap address 'daddr' is incremented in the loop for
each data page, and it can reach the next page boundary.

These problems trigger CONFIG_DEBUG_HIGHMEM warnings, protection errors,
and kernel crash when doing I/O for the storage installed by
'modprobe scsi_debug dif=1 dix=1' on x86_32 with highmem.

Signed-off-by: Akinobu Mita <akinobu.m...@gmail.com>
Cc: "James E.J. Bottomley" <jbottom...@parallels.com>
Cc: Douglas Gilbert <dgilb...@interlog.com>
Cc: "Martin K. Petersen" <martin.peter...@oracle.com>
Cc: linux-scsi@vger.kernel.org
---
 drivers/scsi/scsi_debug.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index aea4c2e..8fd30a5 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1814,12 +1814,12 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, 
sector_t start_sec,
        BUG_ON(scsi_sg_count(SCpnt) == 0);
        BUG_ON(scsi_prot_sg_count(SCpnt) == 0);
 
-       paddr = kmap_atomic(sg_page(psgl)) + psgl->offset;
        ppage_offset = 0;
 
        /* For each data page */
        scsi_for_each_sg(SCpnt, dsgl, scsi_sg_count(SCpnt), i) {
                daddr = kmap_atomic(sg_page(dsgl)) + dsgl->offset;
+               paddr = kmap_atomic(sg_page(psgl)) + psgl->offset;
 
                /* For each sector-sized chunk in data page */
                for (j = 0 ; j < dsgl->length ; j += scsi_debug_sector_size) {
@@ -1904,19 +1904,18 @@ static int prot_verify_write(struct scsi_cmnd *SCpnt, 
sector_t start_sec,
                        ppage_offset += sizeof(struct sd_dif_tuple);
                }
 
-               kunmap_atomic(daddr);
+               kunmap_atomic(paddr);
+               kunmap_atomic(daddr - dsgl->length);
        }
 
-       kunmap_atomic(paddr);
-
        dix_writes++;
 
        return 0;
 
 out:
        dif_errors++;
-       kunmap_atomic(daddr);
        kunmap_atomic(paddr);
+       kunmap_atomic(daddr);
        return ret;
 }
 
-- 
1.8.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to