target: Fix inconsistent address passed to kunmap_atomic() in sbc_dif_copy_prot()

In sbc_dif_copy_prot(), the addresses passed to kunmap_atomic() are
inconsistent with the addresses which are mapped by kmap_atomic().
That could be problematic if an SG element has its length larger than
PAGE_SIZE as kunmap_atomic() will attempt to unmap different page.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
Cc: target-devel@vger.kernel.org
Cc: linux-scsi@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index d441975604db6e386a25d7fa45a1f1c7b883e14f..d615a11dc9c93f8e02e66cdf784715d32429faf3 100644 (file)
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1300,13 +1300,14 @@ void sbc_dif_copy_prot(struct se_cmd *cmd, unsigned int sectors, bool read,
                        copied += len;
                        psg_len -= len;
 
+                       kunmap_atomic(addr - sg->offset - offset);
+
                        if (offset >= sg->length) {
                                sg = sg_next(sg);
                                offset = 0;
                        }
-                       kunmap_atomic(addr);
                }
-               kunmap_atomic(paddr);
+               kunmap_atomic(paddr - psg->offset);
        }
 }
 EXPORT_SYMBOL(sbc_dif_copy_prot);