[SCSI] aacraid: prohibit access to array container space

[safe/jmp/linux-2.6] / drivers / scsi / scsi_tgt_lib.c

diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
index f26299d..66241dd 100644 (file)
--- a/drivers/scsi/scsi_tgt_lib.c
+++ b/drivers/scsi/scsi_tgt_lib.c
@@ -23,6 +23,7 @@
 #include <linux/hash.h>
 #include <linux/module.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -362,7 +363,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
        int err;
 
        dprintk("%lx %u\n", uaddr, len);
-       err = blk_rq_map_user(q, rq, (void *)uaddr, len);
+       err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
        if (err) {
                /*
                 * TODO: need to fixup sg_tablesize, max_segment_size,
@@ -387,7 +388,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
         * we use REQ_TYPE_BLOCK_PC so scsi_init_io doesn't set the
         * length for us.
         */
-       cmd->sdb.length = rq->data_len;
+       cmd->sdb.length = blk_rq_bytes(rq);
 
        return 0;