Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[SCSI] tgt: fix scsi command leak

Browse source 
The failure to map user-space pages leads to scsi command leak. It can
happens mostly because of user-space daemon bugs (or OOM). This patch
makes tgt just notify a LLD of the failure with sense when
blk_rq_map_user() fails.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
This commit is contained in:
FUJITA Tomonori 2007-03-03 09:55:55 +09:00 committed by James Bottomley
parent bc7e380a6a
commit e8f8248cba
1 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
drivers/scsi/scsi_tgt_lib.c
View file

@ -459,6 +459,16 @@ static struct request *tgt_cmd_hash_lookup(struct request_queue *q, u64 tag)
return rq; return rq;
} }
static void scsi_tgt_build_sense(unsigned char *sense_buffer, unsigned char key,
unsigned char asc, unsigned char asq)
{
sense_buffer[0] = 0x70;
sense_buffer[2] = key;
sense_buffer[7] = 0xa;
sense_buffer[12] = asc;
sense_buffer[13] = asq;
}
int scsi_tgt_kspace_exec(int host_no, int result, u64 tag, int scsi_tgt_kspace_exec(int host_no, int result, u64 tag,
unsigned long uaddr, u32 len, unsigned long sense_uaddr, unsigned long uaddr, u32 len, unsigned long sense_uaddr,
u32 sense_len, u8 rw) u32 sense_len, u8 rw)
@ -514,9 +524,16 @@ int scsi_tgt_kspace_exec(int host_no, int result, u64 tag,
if (len) { if (len) {
err = scsi_map_user_pages(rq->end_io_data, cmd, uaddr, len, rw); err = scsi_map_user_pages(rq->end_io_data, cmd, uaddr, len, rw);
if (err) { if (err) {
eprintk("%p %d\n", cmd, err); /*
err = -EAGAIN; * user-space daemon bugs or OOM
goto done; * TODO: we can do better for OOM.
*/
eprintk("cmd %p ret %d uaddr %lx len %d rw %d\n",
cmd, err, uaddr, len, rw);
cmd->result = SAM_STAT_CHECK_CONDITION;
memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
scsi_tgt_build_sense(cmd->sense_buffer,
HARDWARE_ERROR, 0, 0);
} }
} }
err = scsi_tgt_transfer_response(cmd); err = scsi_tgt_transfer_response(cmd);