On Sun, Nov 16 2003, Alan Stern wrote:
> The page count calculations in drivers/scsi/st.c (and copied in sg.c) are
> wrong. The code says:
>
> nr_pages = ((uaddr & ~PAGE_MASK) + count - 1 + ~PAGE_MASK) >>
> PAGE_SHIFT;
>
> That will compute an incorrect value if the user's buffer happens to end
> on the first byte of a new page. Example: Suppose uaddr starts right on
> a page boundary and count is PAGE_SIZE + 1. Then
>
> (uaddr & ~PAGE_MASK) -> 0
> count - 1 -> PAGE_SIZE
> ~PAGE_MASK -> PAGE_SIZE - 1
>
> nr_pages -> (2 * PAGE_SIZE - 1) >> PAGE_SHIFT = 1
>
> when in fact nr_pages should be 2. Either the "- 1" shouldn't be there or
> the second "~PAGE_MASK" should be replaced by "PAGE_SIZE".
Good catch, that's a classic error. page calculations 101? :)
--
Jens Axboe
-
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
