Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e3b2bbb authored by James Bottomley's avatar James Bottomley Committed by James Bottomley
Browse files

[SCSI] 3w-xxxx: fix oops caused by incorrect REQUEST_SENSE handling 



3w-xxxx emulates a REQUEST_SENSE response by simply returning nothing.
Unfortunately, it's assuming that the REQUEST_SENSE command is
implemented with use_sg == 0, which is no longer the case.  The oops
occurs because it's clearing the scatterlist in request_buffer instead
of the memory region.

This is fixed by using tw_transfer_internal() to transfer correctly to
the scatterlist.

Acked-by: default avataradam radford <aradford@gmail.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent 8a065975

drivers/scsi/3w-xxxx.c

+9 −2
Original line number Diff line number Diff line
@@ -1864,10 +1864,17 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id) 
/* This function will handle the request sense scsi command */

static int tw_scsiop_request_sense(TW_Device_Extension *tw_dev, int request_id)

{

	char request_buffer[18];



	dprintk(KERN_NOTICE "3w-xxxx: tw_scsiop_request_sense()\n");



	/* For now we just zero the request buffer */

	memset(tw_dev->srb[request_id]->request_buffer, 0, tw_dev->srb[request_id]->request_bufflen);

	memset(request_buffer, 0, sizeof(request_buffer));

	request_buffer[0] = 0x70; /* Immediate fixed format */

	request_buffer[7] = 10;	/* minimum size per SPC: 18 bytes */

	/* leave all other fields zero, giving effectively NO_SENSE return */

	tw_transfer_internal(tw_dev, request_id, request_buffer,

			     sizeof(request_buffer));



	tw_dev->state[request_id] = TW_S_COMPLETED;

	tw_state_request_finish(tw_dev, request_id);