From: Christof Schmitt <christof.schmitt@de.ibm.com>
Date: Thu, 17 Sep 2009 07:10:14 +0000 (+0200)
Subject: [SCSI] sg: Free data buffers after calling blk_rq_unmap_user
X-Git-Tag: v2.6.32-rc4~9^2~27
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e27168f8c337b12b8aa8d59c3123c79d2f83603d;p=pandora-kernel.git

[SCSI] sg: Free data buffers after calling blk_rq_unmap_user

Running sg_luns on s390x with CONFIG_DEBUG_PAGEALLOC enabled fails
with EFAULT from the SG_IO ioctl. The EFAULT is the result from
copy_to_user failing in this call chain:

sg_ioctl
sg_new_read
sg_finish_rem_req
blk_rq_unmap_user
__blk_rq_unmap_user
bio_uncopy_user
__bio_copy_iov
copy_to_user

The sg driver calls sg_remove_scat to free the memory pages before
calling blk_rq_unmap_user that tries to copy the data back to
userspace. Change the order to first call blk_rq_unmap_user before
freeing the pages in sg_remove_scat.

Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Cc: stable@kernel.org
Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
---

Reading git-diff-tree failed