Commit a54afbc8 authored by Roger Pau Monne's avatar Roger Pau Monne Committed by Keith Busch
Browse files

nvme-pci: DMA unmap the correct regions in nvme_free_sgls 



The call to nvme_free_sgls() in nvme_unmap_data() has the sg_list and sge
parameters swapped.  This wasn't noticed by the compiler because both share
the same type.  On a Xen PV hardware domain, and possibly any other
architectures that takes that path, this leads to corruption of the NVMe
contents.

Fixes: f0887e2a ("nvme-pci: create common sgl unmapping helper")
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarRoger Pau Monné <roger.pau@citrix.com>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent 0fcee2cf

drivers/nvme/host/pci.c

+2 −2
Original line number Diff line number Diff line
@@ -806,8 +806,8 @@ static void nvme_unmap_data(struct request *req) 
	if (!blk_rq_dma_unmap(req, dma_dev, &iod->dma_state, iod->total_len,

			      map)) {

		if (nvme_pci_cmd_use_sgl(&iod->cmd))

			nvme_free_sgls(req, iod->descriptors[0],

				       &iod->cmd.common.dptr.sgl, attrs);

			nvme_free_sgls(req, &iod->cmd.common.dptr.sgl,

			               iod->descriptors[0], attrs);

		else

			nvme_free_prps(req, attrs);

	}