[SCSI] aacraid: prohibit access to array container space

[safe/jmp/linux-2.6] / drivers / scsi / scsi_tgt_lib.c

diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
index 257e097..66241dd 100644 (file)
--- a/drivers/scsi/scsi_tgt_lib.c
+++ b/drivers/scsi/scsi_tgt_lib.c
@@ -23,6 +23,7 @@
 #include <linux/hash.h>
 #include <linux/module.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -362,7 +363,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
        int err;
 
        dprintk("%lx %u\n", uaddr, len);
-       err = blk_rq_map_user(q, rq, (void *)uaddr, len);
+       err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
        if (err) {
                /*
                 * TODO: need to fixup sg_tablesize, max_segment_size,
@@ -387,7 +388,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
         * we use REQ_TYPE_BLOCK_PC so scsi_init_io doesn't set the
         * length for us.
         */
-       cmd->sdb.length = rq->data_len;
+       cmd->sdb.length = blk_rq_bytes(rq);
 
        return 0;
 
@@ -460,7 +461,7 @@ int scsi_tgt_kspace_exec(int host_no, u64 itn_id, int result, u64 tag,
 
        /* TODO: replace with a O(1) alg */
        shost = scsi_host_lookup(host_no);
-       if (IS_ERR(shost)) {
+       if (!shost) {
                printk(KERN_ERR "Could not find host no %d\n", host_no);
                return -EINVAL;
        }
@@ -550,7 +551,7 @@ int scsi_tgt_kspace_tsk_mgmt(int host_no, u64 itn_id, u64 mid, int result)
        dprintk("%d %d %llx\n", host_no, result, (unsigned long long) mid);
 
        shost = scsi_host_lookup(host_no);
-       if (IS_ERR(shost)) {
+       if (!shost) {
                printk(KERN_ERR "Could not find host no %d\n", host_no);
                return err;
        }
@@ -603,7 +604,7 @@ int scsi_tgt_kspace_it_nexus_rsp(int host_no, u64 itn_id, int result)
        dprintk("%d %d%llx\n", host_no, result, (unsigned long long)itn_id);
 
        shost = scsi_host_lookup(host_no);
-       if (IS_ERR(shost)) {
+       if (!shost) {
                printk(KERN_ERR "Could not find host no %d\n", host_no);
                return err;
        }