Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3fa89a04 authored by Stephen M. Cameron's avatar Stephen M. Cameron Committed by Christoph Hellwig
Browse files

hpsa: fix 6-byte READ/WRITE with 0 length data xfer 



a 6-byte READ/WRITE CDB with a 0 block data transfer really
means a 256 block data transfer.  The RAID mapping code failed
to handle this case.  For 10/12/16 byte READ/WRITEs, 0 just means
no data should be transferred, and should not trigger BUG_ON.

Signed-off-by: default avatarStephen M. Cameron <scameron@beardog.cce.hp.com>
Reported-by: default avatarRobert Elliott <elliott@hp.com>
Reviewed-by: default avatarRobert Elliott <elliott@hp.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 2a5ac326

drivers/scsi/hpsa.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -3686,6 +3686,8 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h, 
			(((u64) cmd->cmnd[2]) << 8) |

			(((u64) cmd->cmnd[2]) << 8) |

			cmd->cmnd[3];

			cmd->cmnd[3];

		block_cnt = cmd->cmnd[4];

		block_cnt = cmd->cmnd[4];

		if (block_cnt == 0)

			block_cnt = 256;

		break;

		break;

	case WRITE_10:

	case WRITE_10:

		is_write = 1;

		is_write = 1;
@@ -3734,7 +3736,6 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h, 
	default:

	default:

		return IO_ACCEL_INELIGIBLE; /* process via normal I/O path */

		return IO_ACCEL_INELIGIBLE; /* process via normal I/O path */

	}

	}

	BUG_ON(block_cnt == 0);

	last_block = first_block + block_cnt - 1;

	last_block = first_block + block_cnt - 1;





	/* check for write to non-RAID-0 */

	/* check for write to non-RAID-0 */