NVMe: Fix off-by-one when filling in PRP lists

[~andy/linux] / drivers / block / nvme.c

diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index 0d5c918b7d59b623d9ae50185557eafe022bf44c..cf89db8c41eecdedee5a498eb1d72b5a22578f5b 100644 (file)
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -376,12 +376,13 @@ static struct nvme_prps *nvme_setup_prps(struct nvme_dev *dev,
        cmd->prp2 = cpu_to_le64(prp_dma);
        i = 0;
        for (;;) {
-               if (i == PAGE_SIZE / 8 - 1) {
+               if (i == PAGE_SIZE / 8) {
                        __le64 *old_prp_list = prp_list;
                        prp_list = dma_pool_alloc(pool, GFP_ATOMIC, &prp_dma);
                        prps->list[prp_page++] = prp_list;
-                       old_prp_list[i] = cpu_to_le64(prp_dma);
-                       i = 0;
+                       prp_list[0] = old_prp_list[i - 1];
+                       old_prp_list[i - 1] = cpu_to_le64(prp_dma);
+                       i = 1;
                }
                prp_list[i++] = cpu_to_le64(dma_addr);
                dma_len -= PAGE_SIZE;