[lkml]   [2000]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: 2.3.48, NCR53C81a and CD-ROM

On Tue, 29 Feb 2000, David S. Miller wrote:

> Date: Tue, 29 Feb 2000 23:38:24 +0100 (MET)
> From: Gerard Roudier <>
> The sym53c8xx driver now trusts the data transfer direction of SCSI
> commands supplied by upper layers. If this information is wrong, this will
> not work. (I will try to let the driver detect properly bad data phase in
> some further driver version).
> My-be, the application you are using sends an IOCTL_SEND_COMMAND to some
> drivers and if a non zero input buffer length is provided direction is
> assumed WRITE by scsi_ioctl.c, which is wrong for INQUIRY (just guessing).
> You are partially correct Gerard.
> The problem is in fact that sc_data_direction is left set at
> SCSI_DATA_NONE for a scsi command that actually does transfer
> data.
> The culprit is sr.c:sr_packet().
> So the bug is that the generic cdrom layer needs to pass a data
> direction into the CDROM packet driver function, and I've told
> Jens Axboe to work on fixing this. I've CC:'d him here as a
> reminder.


By the way, scsi_ioctl_send_command() declares the variables 'inlen',
'outlen', 'needed' and 'buf_needed' as '_signed_ int' but all its code is
dealing with them as if they were 'unsigned'. This looks like a more
serious bug to me given that inputs come from user-space.

How much currect am I there ? :-)

> Any CDROM mount or other access will trigger this.

I noticed the problem when testing my latest driver changes (couldn't
mount my CD/ROM), but haven't have time to investigate. :-)


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:56    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean