Commit 7551d9a2 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] 3ware: kmap_atomic() fix

We must disable local IRQs while holding KM_IRQ0 or KM_IRQ1.  Otherwise, an
IRQ handler could use those kmap slots while this code is using them,
resulting in memory corruption.

Thanks to Nick Orlov <bugfixer@list.ru> for reporting.

Cc: <linuxraid@amcc.com>
Cc: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent b3f28a9a
...@@ -1508,10 +1508,12 @@ static void tw_transfer_internal(TW_Device_Extension *tw_dev, int request_id, ...@@ -1508,10 +1508,12 @@ static void tw_transfer_internal(TW_Device_Extension *tw_dev, int request_id,
struct scsi_cmnd *cmd = tw_dev->srb[request_id]; struct scsi_cmnd *cmd = tw_dev->srb[request_id];
void *buf; void *buf;
unsigned int transfer_len; unsigned int transfer_len;
unsigned long flags = 0;
if (cmd->use_sg) { if (cmd->use_sg) {
struct scatterlist *sg = struct scatterlist *sg =
(struct scatterlist *)cmd->request_buffer; (struct scatterlist *)cmd->request_buffer;
local_irq_save(flags);
buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset; buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
transfer_len = min(sg->length, len); transfer_len = min(sg->length, len);
} else { } else {
...@@ -1526,6 +1528,7 @@ static void tw_transfer_internal(TW_Device_Extension *tw_dev, int request_id, ...@@ -1526,6 +1528,7 @@ static void tw_transfer_internal(TW_Device_Extension *tw_dev, int request_id,
sg = (struct scatterlist *)cmd->request_buffer; sg = (struct scatterlist *)cmd->request_buffer;
kunmap_atomic(buf - sg->offset, KM_IRQ0); kunmap_atomic(buf - sg->offset, KM_IRQ0);
local_irq_restore(flags);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment