Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53ca3535 authored Dec 10, 2009 by Adam Radford Committed by James Bottomley Dec 12, 2009

[SCSI] 3w-9xxx fix bug in sgl loading

This small patch fixes a bug in the 3w-9xxx driver where it would load
an invalid sgl address in the ioctl path even if request length was zero.

Signed-off-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>

parent 55a66d3c

drivers/scsi/3w-9xxx.c

+7 −4

Original line number	Original line	Diff line number	Diff line
	@@ -76,6 +76,7 @@
	Fix bug in twa_get_param() on 4GB+.		Fix bug in twa_get_param() on 4GB+.
	Use pci_resource_len() for ioremap().		Use pci_resource_len() for ioremap().
	2.26.02.012 - Add power management support.		2.26.02.012 - Add power management support.
			2.26.02.013 - Fix bug in twa_load_sgl().
	*/		*/

	#include <linux/module.h>		#include <linux/module.h>
	@@ -100,7 +101,7 @@
	#include "3w-9xxx.h"		#include "3w-9xxx.h"

	/* Globals */		/* Globals */
	#define TW_DRIVER_VERSION "2.26.02.012"		#define TW_DRIVER_VERSION "2.26.02.013"
	static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];		static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
	static unsigned int twa_device_extension_count;		static unsigned int twa_device_extension_count;
	static int twa_major = -1;		static int twa_major = -1;
	@@ -1382,10 +1383,12 @@ static void twa_load_sgl(TW_Device_Extension tw_dev, TW_Command_Full full_comm
	newcommand = &full_command_packet->command.newcommand;		newcommand = &full_command_packet->command.newcommand;
	newcommand->request_id__lunl =		newcommand->request_id__lunl =
	cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));		cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
			if (length) {
	newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);		newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
	newcommand->sg_list[0].length = cpu_to_le32(length);		newcommand->sg_list[0].length = cpu_to_le32(length);
			}
	newcommand->sgl_entries__lunh =		newcommand->sgl_entries__lunh =
	cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), 1));		cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
	} else {		} else {
	oldcommand = &full_command_packet->command.oldcommand;		oldcommand = &full_command_packet->command.oldcommand;
	oldcommand->request_id = request_id;		oldcommand->request_id = request_id;