Skip to contentSkip to conversation

sbp2: remove broken inquiry mangling

PATCH In review Christoph Hellwig 2 participants 3 messages Jun 3, 2006 SCSI

lore
Share & tools
lore

Christoph Hellwig

author
#0 lore raw

PATCH 1/1 sbp2: remove broken inquiry mangling

scsi_cmnd.request_buffer is always a scatterlist these days. Checking random bites into it and then mangling the data in sbp2_check_sbp2_response will cause really bad memory corruption when you're not lucky enough to have the check not trigger by luck.

Signed-off-by Christoph Hellwig <[email protected]>
drivers/ieee1394/sbp2.c +0 -34
Index: scsi-misc-2.6/drivers/ieee1394/sbp2.c
===================================================================
@@ -2038,33 +2038,6 @@
 }
 
 /*
- * This function is called after a command is completed, in order to do any necessary SBP-2
- * response data translations for the SCSI stack
- */
-static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,
-				     struct scsi_cmnd *SCpnt)
-{
-	u8 *scsi_buf = SCpnt->request_buffer;
-
-	SBP2_DEBUG_ENTER();
-
-	if (SCpnt->cmnd[0] == INQUIRY && (SCpnt->cmnd[1] & 3) == 0) {
-		/*
-		 * Make sure data length is ok. Minimum length is 36 bytes
-		 */
-		if (scsi_buf[4] == 0) {
-			scsi_buf[4] = 36 - 5;
-		}
-
-		/*
-		 * Fix ansi revision and response data format
-		 */
-		scsi_buf[2] |= 2;
-		scsi_buf[3] = (scsi_buf[3] & 0xf0) | 2;
-	}
-}
-
-/*
  * This function deals with status writes from the SBP-2 device
  */
 static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int destid,

@@ -2403,13 +2376,6 @@
 	}
 
 	/*
-	 * Take care of any sbp2 response data mucking here (RBC stuff, etc.)
-	 */
-	if (SCpnt->result == DID_OK << 16) {
-		sbp2_check_sbp2_response(scsi_id, SCpnt);
-	}
-
-	/*
 	 * If a bus reset is in progress and there was an error, complete
 	 * the command as busy so that it will get retried.
 	 */
drivers/ieee1394/sbp2.h +0 -2
Index: scsi-misc-2.6/drivers/ieee1394/sbp2.h
===================================================================
@@ -398,8 +398,6 @@
 			     struct scsi_cmnd *SCpnt,
 			     void (*done)(struct scsi_cmnd *));
 static unsigned int sbp2_status_to_sense_data(unchar *sbp2_status, unchar *sense_data);
-static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,
-				     struct scsi_cmnd *SCpnt);
 static void sbp2_parse_unit_directory(struct scsi_id_instance_data *scsi_id,
 				      struct unit_directory *ud);
 static int sbp2_set_busy_timeout(struct scsi_id_instance_data *scsi_id);
#1 lore raw
Quoted 13 lines · Christoph Hellwig

scsi_cmnd.request_buffer is always a scatterlist these days. Checking random bites into it and then mangling the data in sbp2_check_sbp2_response will cause really bad memory corruption when you're not lucky enough to have the check not trigger by luck.

Signed-off-by Christoph Hellwig <[email protected]>

Index: scsi-misc-2.6/drivers/ieee1394/sbp2.c
===================================================================

drivers/ieee1394/sbp2.c line 2046

Quoted 9 lines
drivers/ieee1394/sbp2.c +0 -6
@@ -2038,33 +2038,6 @@
 }
 
 /*
- * This function is called after a command is completed, in order to do any necessary SBP-2
- * response data translations for the SCSI stack
- */
-static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,
-				     struct scsi_cmnd *SCpnt)
-{

[...]

Thanks, but this change plus minor whitespace edits made it "already" into -mm:
sbp2: remove manipulation of inquiry response
http://marc.theaimsgroup.com/?l=linux-mm-commits&m=114928458408313

Signature · 3 lines
Stefan Richter
-=====-=-==- -==- ---==
http://arcgraph.de/sr/