lkml.org 
[lkml]   [2000]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.3.48, NCR53C81a and CD-ROM


On Tue, 29 Feb 2000, David S. Miller wrote:

> Date: Tue, 29 Feb 2000 23:38:24 +0100 (MET)
> From: Gerard Roudier <groudier@club-internet.fr>
>
> The sym53c8xx driver now trusts the data transfer direction of SCSI
> commands supplied by upper layers. If this information is wrong, this will
> not work. (I will try to let the driver detect properly bad data phase in
> some further driver version).
>
> My-be, the application you are using sends an IOCTL_SEND_COMMAND to some
> drivers and if a non zero input buffer length is provided direction is
> assumed WRITE by scsi_ioctl.c, which is wrong for INQUIRY (just guessing).
>
> You are partially correct Gerard.
>
> The problem is in fact that sc_data_direction is left set at
> SCSI_DATA_NONE for a scsi command that actually does transfer
> data.
>
> The culprit is sr.c:sr_packet().
>
> So the bug is that the generic cdrom layer needs to pass a data
> direction into the CDROM packet driver function, and I've told
> Jens Axboe to work on fixing this. I've CC:'d him here as a
> reminder.

Ok.

By the way, scsi_ioctl_send_command() declares the variables 'inlen',
'outlen', 'needed' and 'buf_needed' as '_signed_ int' but all its code is
dealing with them as if they were 'unsigned'. This looks like a more
serious bug to me given that inputs come from user-space.

How much currect am I there ? :-)

> Any CDROM mount or other access will trigger this.

I noticed the problem when testing my latest driver changes (couldn't
mount my CD/ROM), but haven't have time to investigate. :-)

Gérard.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:56    [W:0.977 / U:1.012 seconds]
©2003-2014 Jasper Spaans. Advertise on this site