1 files changed, 35 insertions, 17 deletions

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 4b79a1f2f901..e663921eebb6 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -461,7 +461,7 @@ static void tcm_vhost_release_cmd(struct se_cmd *se_cmd)
                 u32 i;
                 for (i = 0; i < tv_cmd->tvc_sgl_count; i++)
                         put_page(sg_page(&tv_cmd->tvc_sgl[i]));
-        }
+        }
 
         tcm_vhost_put_inflight(tv_cmd->inflight);
         percpu_ida_free(&se_sess->sess_tag_pool, se_cmd->map_tag);
@@ -728,7 +728,12 @@ vhost_scsi_get_tag(struct vhost_virtqueue *vq,
         }
         se_sess = tv_nexus->tvn_se_sess;
 
-        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_KERNEL);
+        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
+        if (tag < 0) {
+                pr_err("Unable to obtain tag for tcm_vhost_cmd\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
         cmd = &((struct tcm_vhost_cmd *)se_sess->sess_cmd_map)[tag];
         sg = cmd->tvc_sgl;
         pages = cmd->tvc_upages;
@@ -1051,7 +1056,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                 if (data_direction != DMA_NONE) {
                         ret = vhost_scsi_map_iov_to_sgl(cmd,
                                         &vq->iov[data_first], data_num,
-                                        data_direction == DMA_TO_DEVICE);
+                                        data_direction == DMA_FROM_DEVICE);
                         if (unlikely(ret)) {
                                 vq_err(vq, "Failed to map iov to sgl\n");
                                 goto err_free;
@@ -1373,21 +1378,30 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
         return 0;
 }
 
+static void vhost_scsi_free(struct vhost_scsi *vs)
+{
+        if (is_vmalloc_addr(vs))
+                vfree(vs);
+        else
+                kfree(vs);
+}
+
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
         struct vhost_scsi *vs;
         struct vhost_virtqueue **vqs;
-        int r, i;
+        int r = -ENOMEM, i;
 
-        vs = kzalloc(sizeof(*vs), GFP_KERNEL);
-        if (!vs)
-                return -ENOMEM;
+        vs = kzalloc(sizeof(*vs), GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
+        if (!vs) {
+                vs = vzalloc(sizeof(*vs));
+                if (!vs)
+                        goto err_vs;
+        }
 
         vqs = kmalloc(VHOST_SCSI_MAX_VQ * sizeof(*vqs), GFP_KERNEL);
-        if (!vqs) {
-                kfree(vs);
-                return -ENOMEM;
-        }
+        if (!vqs)
+                goto err_vqs;
 
         vhost_work_init(&vs->vs_completion_work, vhost_scsi_complete_cmd_work);
         vhost_work_init(&vs->vs_event_work, tcm_vhost_evt_work);
@@ -1407,14 +1421,18 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
 
         tcm_vhost_init_inflight(vs, NULL);
 
-        if (r < 0) {
-                kfree(vqs);
-                kfree(vs);
-                return r;
-        }
+        if (r < 0)
+                goto err_init;
 
         f->private_data = vs;
         return 0;
+
+err_init:
+        kfree(vqs);
+err_vqs:
+        vhost_scsi_free(vs);
+err_vs:
+        return r;
 }
 
 static int vhost_scsi_release(struct inode *inode, struct file *f)
@@ -1431,7 +1449,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
         /* Jobs can re-queue themselves in evt kick handler. Do extra flush. */
         vhost_scsi_flush(vs);
         kfree(vs->dev.vqs);
-        kfree(vs);
+        vhost_scsi_free(vs);
         return 0;
 }