Commit bd441dea authored by Mike Christie's avatar Mike Christie Committed by James Bottomley

[SCSI] fix write buffer length in scsi_req_map_sg()

sg's may have setup a the buffer with a different length than
the transfer length so we should be using the bufflen passed
in as the request's data len.
Signed-off-by: default avatarMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent 35814740
...@@ -301,7 +301,7 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl, ...@@ -301,7 +301,7 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
{ {
struct request_queue *q = rq->q; struct request_queue *q = rq->q;
int nr_pages = (bufflen + sgl[0].offset + PAGE_SIZE - 1) >> PAGE_SHIFT; int nr_pages = (bufflen + sgl[0].offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
unsigned int data_len = 0, len, bytes, off; unsigned int data_len = bufflen, len, bytes, off;
struct page *page; struct page *page;
struct bio *bio = NULL; struct bio *bio = NULL;
int i, err, nr_vecs = 0; int i, err, nr_vecs = 0;
...@@ -310,10 +310,15 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl, ...@@ -310,10 +310,15 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
page = sgl[i].page; page = sgl[i].page;
off = sgl[i].offset; off = sgl[i].offset;
len = sgl[i].length; len = sgl[i].length;
data_len += len;
while (len > 0) { while (len > 0 && data_len > 0) {
/*
* sg sends a scatterlist that is larger than
* the data_len it wants transferred for certain
* IO sizes
*/
bytes = min_t(unsigned int, len, PAGE_SIZE - off); bytes = min_t(unsigned int, len, PAGE_SIZE - off);
bytes = min(bytes, data_len);
if (!bio) { if (!bio) {
nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages); nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages);
...@@ -345,12 +350,13 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl, ...@@ -345,12 +350,13 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
page++; page++;
len -= bytes; len -= bytes;
data_len -=bytes;
off = 0; off = 0;
} }
} }
rq->buffer = rq->data = NULL; rq->buffer = rq->data = NULL;
rq->data_len = data_len; rq->data_len = bufflen;
return 0; return 0;
free_bios: free_bios:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment