lkml.org 
[lkml]   [2019]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 59/68] libata: add SG safety checks in SFF pio transfers
    Date
    From: Jens Axboe <axboe@kernel.dk>

    [ Upstream commit 752ead44491e8c91e14d7079625c5916b30921c5 ]

    Abort processing of a command if we run out of mapped data in the
    SG list. This should never happen, but a previous bug caused it to
    be possible. Play it safe and attempt to abort nicely if we don't
    have more SG segments left.

    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/ata/libata-sff.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
    index c5ea0fc635e54..873cc09060551 100644
    --- a/drivers/ata/libata-sff.c
    +++ b/drivers/ata/libata-sff.c
    @@ -674,6 +674,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
    unsigned int offset;
    unsigned char *buf;

    + if (!qc->cursg) {
    + qc->curbytes = qc->nbytes;
    + return;
    + }
    if (qc->curbytes == qc->nbytes - qc->sect_size)
    ap->hsm_task_state = HSM_ST_LAST;

    @@ -699,6 +703,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)

    if (qc->cursg_ofs == qc->cursg->length) {
    qc->cursg = sg_next(qc->cursg);
    + if (!qc->cursg)
    + ap->hsm_task_state = HSM_ST_LAST;
    qc->cursg_ofs = 0;
    }
    }
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-08-14 04:27    [W:4.135 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site