lkml.org 
[lkml]   [2012]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 17/34] SCSI: 3w-9xxx fix bug in sgl loading
    2.6.32-longterm review patch.  If anyone has any objections, please let me know.

    ------------------
    From: adam radford <aradford@gmail.com>

    commit 53ca353594a254e6bd45ccf2d405aa31bcbb7091 upstream.

    This small patch fixes a bug in the 3w-9xxx driver where it would load
    an invalid sgl address in the ioctl path even if request length was zero.

    Signed-off-by: Adam Radford <aradford@gmail.com>
    Signed-off-by: James Bottomley <James.Bottomley@suse.de>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/scsi/3w-9xxx.c | 11 +++++++----
    1 file changed, 7 insertions(+), 4 deletions(-)
    --- a/drivers/scsi/3w-9xxx.c
    +++ b/drivers/scsi/3w-9xxx.c
    @@ -76,6 +76,7 @@
    Fix bug in twa_get_param() on 4GB+.
    Use pci_resource_len() for ioremap().
    2.26.02.012 - Add power management support.
    + 2.26.02.013 - Fix bug in twa_load_sgl().
    */

    #include <linux/module.h>
    @@ -100,7 +101,7 @@
    #include "3w-9xxx.h"

    /* Globals */
    -#define TW_DRIVER_VERSION "2.26.02.012"
    +#define TW_DRIVER_VERSION "2.26.02.013"
    static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
    static unsigned int twa_device_extension_count;
    static int twa_major = -1;
    @@ -1378,10 +1379,12 @@ static void twa_load_sgl(TW_Device_Exten
    newcommand = &full_command_packet->command.newcommand;
    newcommand->request_id__lunl =
    cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
    - newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
    - newcommand->sg_list[0].length = cpu_to_le32(length);
    + if (length) {
    + newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
    + newcommand->sg_list[0].length = cpu_to_le32(length);
    + }
    newcommand->sgl_entries__lunh =
    - cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), 1));
    + cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
    } else {
    oldcommand = &full_command_packet->command.oldcommand;
    oldcommand->request_id = request_id;



    \
     
     \ /
      Last update: 2012-03-01 22:59    [from the cache]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean