/[linux-patches]/genpatches-2.6/trunk/2.6.14/1173_5_scsi-transfer-direction-fix.patch
Gentoo

Contents of /genpatches-2.6/trunk/2.6.14/1173_5_scsi-transfer-direction-fix.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 292 - (show annotations) (download) (as text)
Tue Jan 31 21:50:53 2006 UTC (14 years, 9 months ago) by johnm
File MIME type: text/x-diff
File size: 3262 byte(s)
Large update - thanks goes to Kerin Millar for the legwork.
1 From: Stefan Richter <stefanr@s5r6.in-berlin.de>
2 Date: Wed, 14 Dec 2005 22:32:33 +0000 (+0100)
3 Subject: [PATCH] SCSI: fix transfer direction in sd (kernel panic when ejecting iPod)
4 X-Git-Url: http://kernel.org/git/?p=linux/kernel/git/gregkh/linux-2.6.14.y.git;a=commitdiff;h=8e58cb47ade0e69f3c953a41b67913c430c67879
5
6 [PATCH] SCSI: fix transfer direction in sd (kernel panic when ejecting iPod)
7
8 SCSI: fix transfer direction in sd (kernel panic when ejecting iPod)
9
10 sd_init_command could issue WRITE requests with zero buffer length.
11 This may lead to kernel panic or oops with some SCSI low-level drivers.
12 Seen with the command "eject /dev/sdX" when disconnecting an iPod:
13 http://marc.theaimsgroup.com/?l=linux1394-devel&m=113399994920181
14 http://marc.theaimsgroup.com/?l=linux1394-user&m=112152701817435
15
16 Derived from -rc patches from Jens Axboe and James Bottomley.
17
18 Patch is reassembled for -stable from patches:
19 [SCSI] fix panic when ejecting ieee1394 ipod
20 [SCSI] Consolidate REQ_BLOCK_PC handling path (fix ipod panic)
21
22 Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
23 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
24 ---
25
26 --- a/drivers/scsi/scsi_lib.c
27 +++ b/drivers/scsi/scsi_lib.c
28 @@ -1129,6 +1129,26 @@ static void scsi_generic_done(struct scs
29 scsi_io_completion(cmd, cmd->result == 0 ? cmd->bufflen : 0, 0);
30 }
31
32 +void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries)
33 +{
34 + struct request *req = cmd->request;
35 +
36 + BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd));
37 + memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
38 + cmd->cmd_len = req->cmd_len;
39 + if (!req->data_len)
40 + cmd->sc_data_direction = DMA_NONE;
41 + else if (rq_data_dir(req) == WRITE)
42 + cmd->sc_data_direction = DMA_TO_DEVICE;
43 + else
44 + cmd->sc_data_direction = DMA_FROM_DEVICE;
45 +
46 + cmd->transfersize = req->data_len;
47 + cmd->allowed = retries;
48 + cmd->timeout_per_command = req->timeout;
49 +}
50 +EXPORT_SYMBOL_GPL(scsi_setup_blk_pc_cmnd);
51 +
52 static int scsi_prep_fn(struct request_queue *q, struct request *req)
53 {
54 struct scsi_device *sdev = q->queuedata;
55 --- a/drivers/scsi/sd.c
56 +++ b/drivers/scsi/sd.c
57 @@ -231,24 +231,10 @@ static int sd_init_command(struct scsi_c
58 * SG_IO from block layer already setup, just copy cdb basically
59 */
60 if (blk_pc_request(rq)) {
61 - if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd))
62 - return 0;
63 -
64 - memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
65 - SCpnt->cmd_len = rq->cmd_len;
66 - if (rq_data_dir(rq) == WRITE)
67 - SCpnt->sc_data_direction = DMA_TO_DEVICE;
68 - else if (rq->data_len)
69 - SCpnt->sc_data_direction = DMA_FROM_DEVICE;
70 - else
71 - SCpnt->sc_data_direction = DMA_NONE;
72 -
73 - this_count = rq->data_len;
74 + scsi_setup_blk_pc_cmnd(SCpnt, SD_PASSTHROUGH_RETRIES);
75 if (rq->timeout)
76 timeout = rq->timeout;
77
78 - SCpnt->transfersize = rq->data_len;
79 - SCpnt->allowed = SD_PASSTHROUGH_RETRIES;
80 goto queue;
81 }
82
83 --- a/include/scsi/scsi_cmnd.h
84 +++ b/include/scsi/scsi_cmnd.h
85 @@ -150,5 +150,6 @@ extern struct scsi_cmnd *scsi_get_comman
86 extern void scsi_put_command(struct scsi_cmnd *);
87 extern void scsi_io_completion(struct scsi_cmnd *, unsigned int, unsigned int);
88 extern void scsi_finish_command(struct scsi_cmnd *cmd);
89 +extern void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries);
90
91 #endif /* _SCSI_SCSI_CMND_H */

  ViewVC Help
Powered by ViewVC 1.1.20