| From 790e1c4627dab06b7c01bc8d3c2e443f00c8b836 Mon Sep 17 00:00:00 2001 |
| From: Johannes Thumshirn <jthumshirn@suse.de> |
| Date: Tue, 31 Jan 2017 10:16:00 +0100 |
| Subject: [PATCH] scsi: don't BUG_ON() empty DMA transfers |
| |
| commit fd3fc0b4d7305fa7246622dcc0dec69c42443f45 upstream. |
| |
| Don't crash the machine just because of an empty transfer. Use WARN_ON() |
| combined with returning an error. |
| |
| Found by Dmitry Vyukov and syzkaller. |
| |
| [ Changed to "WARN_ON_ONCE()". Al has a patch that should fix the root |
| cause, but a BUG_ON() is not acceptable in any case, and a WARN_ON() |
| might still be a cause of excessive log spamming. |
| |
| NOTE! If this warning ever triggers, we may end up leaking resources, |
| since this doesn't bother to try to clean the command up. So this |
| WARN_ON_ONCE() triggering does imply real problems. But BUG_ON() is |
| much worse. |
| |
| People really need to stop using BUG_ON() for "this shouldn't ever |
| happen". It makes pretty much any bug worse. - Linus ] |
| |
| Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de> |
| Reported-by: Dmitry Vyukov <dvyukov@google.com> |
| Cc: James Bottomley <jejb@linux.vnet.ibm.com> |
| Cc: Al Viro <viro@zeniv.linux.org.uk> |
| Cc: stable@kernel.org |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c |
| index c71344aebdbb..cac26d2ece11 100644 |
| --- a/drivers/scsi/scsi_lib.c |
| +++ b/drivers/scsi/scsi_lib.c |
| @@ -1031,7 +1031,8 @@ int scsi_init_io(struct scsi_cmnd *cmd) |
| bool is_mq = (rq->mq_ctx != NULL); |
| int error; |
| |
| - BUG_ON(!rq->nr_phys_segments); |
| + if (WARN_ON_ONCE(!rq->nr_phys_segments)) |
| + return -EINVAL; |
| |
| error = scsi_init_sgtable(rq, &cmd->sdb); |
| if (error) |
| -- |
| 2.12.0 |
| |
