mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-11 13:04:03 +08:00
[SCSI] libfc: Fix frags in frame exceeding SKB_MAX_FRAGS in fc_fcp_send_data
In case of sequence offload, in fc_fcp_send_data(), the skb_fill_page_info() called may end up adding more frags to the skb_shinfo(fp_skb(fp))->frags[], exceeding SKB_MAX_FRAGS, this eventually corrupts the memory. I am adding the FR_FRAME_SG_LEN back, but as SKB_MAX_FRAGS -1, leaving 1 for our fcoe_eof_crc page. And send will be broken into multiple large sends if the frame already contains more frags than skb handle. Signed-off-by: Yi Zou <yi.zou@intel.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <James.Bottomley@suse.de>
This commit is contained in:
parent
7221d7e59d
commit
d37322a43e
@ -574,7 +574,8 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
|
|||||||
tlen -= sg_bytes;
|
tlen -= sg_bytes;
|
||||||
remaining -= sg_bytes;
|
remaining -= sg_bytes;
|
||||||
|
|
||||||
if (tlen)
|
if ((skb_shinfo(fp_skb(fp))->nr_frags < FC_FRAME_SG_LEN) &&
|
||||||
|
(tlen))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -37,6 +37,9 @@
|
|||||||
#define FC_FRAME_HEADROOM 32 /* headroom for VLAN + FCoE headers */
|
#define FC_FRAME_HEADROOM 32 /* headroom for VLAN + FCoE headers */
|
||||||
#define FC_FRAME_TAILROOM 8 /* trailer space for FCoE */
|
#define FC_FRAME_TAILROOM 8 /* trailer space for FCoE */
|
||||||
|
|
||||||
|
/* Max number of skb frags allowed, reserving one for fcoe_crc_eof page */
|
||||||
|
#define FC_FRAME_SG_LEN (MAX_SKB_FRAGS - 1)
|
||||||
|
|
||||||
#define fp_skb(fp) (&((fp)->skb))
|
#define fp_skb(fp) (&((fp)->skb))
|
||||||
#define fr_hdr(fp) ((fp)->skb.data)
|
#define fr_hdr(fp) ((fp)->skb.data)
|
||||||
#define fr_len(fp) ((fp)->skb.len)
|
#define fr_len(fp) ((fp)->skb.len)
|
||||||
|
Loading…
Reference in New Issue
Block a user