Blame SOURCES/0004-Create-safe-16-32-64-bit-accessors-for-reading-from-.patch

dc245c
From d280ce8ad742426bebe610ebfd8559b46876f4ee Mon Sep 17 00:00:00 2001
dc245c
From: Ronnie Sahlberg <ronniesahlberg@gmail.com>
dc245c
Date: Mon, 22 Apr 2013 22:11:53 -0700
dc245c
Subject: [RHEL7 libiscsi PATCH 04/18] Create safe 16/32/64 bit accessors for reading from the
dc245c
 datain buffer and use it throughout the scsi lowlevel file.
dc245c
dc245c
We probably want a safe accessor for byte access to at some stage.
dc245c
dc245c
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
dc245c
(cherry-picked from upstream commit d280ce8ad742426bebe610ebfd8559b46876f4ee)
dc245c
---
dc245c
 lib/scsi-lowlevel.c | 154 +++++++++++++++++++++++++++++++++-------------------
dc245c
 1 file changed, 98 insertions(+), 56 deletions(-)
dc245c
dc245c
diff --git a/lib/scsi-lowlevel.c b/lib/scsi-lowlevel.c
dc245c
index c517d57..77c0bb6 100644
dc245c
--- a/lib/scsi-lowlevel.c
dc245c
+++ b/lib/scsi-lowlevel.c
dc245c
@@ -232,6 +232,48 @@ scsi_get_uint16(const unsigned char *c)
dc245c
 	return ntohs(*(uint16_t *)c);
dc245c
 }
dc245c
 
dc245c
+static inline uint64_t
dc245c
+task_get_uint64(struct scsi_task *task, int offset)
dc245c
+{
dc245c
+	if (offset <= task->datain.size - 8) {
dc245c
+		const unsigned char *c = &task->datain.data[offset];
dc245c
+		uint64_t val;
dc245c
+
dc245c
+		val = ntohl(*(uint32_t *)c);
dc245c
+		val <<= 32;
dc245c
+		c += 4;
dc245c
+		val |= ntohl(*(uint32_t *)c);
dc245c
+
dc245c
+		return val;
dc245c
+	} else {
dc245c
+		return 0;
dc245c
+	}
dc245c
+}
dc245c
+
dc245c
+static inline uint32_t
dc245c
+task_get_uint32(struct scsi_task *task, int offset)
dc245c
+{
dc245c
+	if (offset <= task->datain.size - 4) {
dc245c
+		const unsigned char *c = &task->datain.data[offset];
dc245c
+
dc245c
+		return ntohl(*(uint32_t *)c);
dc245c
+	} else {
dc245c
+		return 0;
dc245c
+	}
dc245c
+}
dc245c
+
dc245c
+static inline uint16_t
dc245c
+task_get_uint16(struct scsi_task *task, int offset)
dc245c
+{
dc245c
+	if (offset <= task->datain.size - 2) {
dc245c
+		const unsigned char *c = &task->datain.data[offset];
dc245c
+
dc245c
+		return ntohs(*(uint16_t *)c);
dc245c
+	} else {
dc245c
+		return 0;
dc245c
+	}
dc245c
+}
dc245c
+
dc245c
 inline void
dc245c
 scsi_set_uint64(unsigned char *c, uint64_t v)
dc245c
 {
dc245c
@@ -319,7 +361,7 @@ scsi_reportluns_datain_getfullsize(struct scsi_task *task)
dc245c
 {
dc245c
 	uint32_t list_size;
dc245c
 
dc245c
-	list_size = scsi_get_uint32(&task->datain.data[0]) + 8;
dc245c
+	list_size = task_get_uint32(task, 0) + 8;
dc245c
 
dc245c
 	return list_size;
dc245c
 }
dc245c
@@ -338,7 +380,7 @@ scsi_reportluns_datain_unmarshall(struct scsi_task *task)
dc245c
 		return NULL;
dc245c
 	}
dc245c
 
dc245c
-	list_size = scsi_get_uint32(&task->datain.data[0]) + 8;
dc245c
+	list_size = task_get_uint32(task, 0) + 8;
dc245c
 	if (list_size < task->datain.size) {
dc245c
 		return NULL;
dc245c
 	}
dc245c
@@ -352,7 +394,7 @@ scsi_reportluns_datain_unmarshall(struct scsi_task *task)
dc245c
 
dc245c
 	list->num = num_luns;
dc245c
 	for (i = 0; i < num_luns; i++) {
dc245c
-		list->luns[i] = scsi_get_uint16(&task->datain.data[i*8+8]);
dc245c
+		list->luns[i] = task_get_uint16(task, i * 8 + 8);
dc245c
 	}
dc245c
 
dc245c
 	return list;
dc245c
@@ -442,7 +484,7 @@ scsi_readtoc_datain_getfullsize(struct scsi_task *task)
dc245c
 {
dc245c
 	uint16_t toc_data_len;
dc245c
 
dc245c
-	toc_data_len = scsi_get_uint16(&task->datain.data[0]) + 2;
dc245c
+	toc_data_len = task_get_uint16(task, 0) + 2;
dc245c
 
dc245c
 	return toc_data_len;
dc245c
 }
dc245c
@@ -465,7 +507,7 @@ scsi_readtoc_desc_unmarshall(struct scsi_task *task, struct scsi_readtoc_list *l
dc245c
 		list->desc[i].desc.toc.track
dc245c
 			= task->datain.data[4+8*i+2];
dc245c
 		list->desc[i].desc.toc.lba
dc245c
-			= scsi_get_uint32(&task->datain.data[4+8*i+4]);
dc245c
+			= task_get_uint32(task, 4 + 8 * i + 4);
dc245c
 		break;
dc245c
 	case SCSI_READ_SESSION_INFO:
dc245c
 		list->desc[i].desc.ses.adr
dc245c
@@ -475,7 +517,7 @@ scsi_readtoc_desc_unmarshall(struct scsi_task *task, struct scsi_readtoc_list *l
dc245c
 		list->desc[i].desc.ses.first_in_last
dc245c
 			= task->datain.data[4+8*i+2];
dc245c
 		list->desc[i].desc.ses.lba
dc245c
-			= scsi_get_uint32(&task->datain.data[4+8*i+4]);
dc245c
+			= task_get_uint32(task, 4 + 8 * i + 4);
dc245c
 		break;
dc245c
 	case SCSI_READ_FULL_TOC:
dc245c
 		list->desc[i].desc.full.session
dc245c
@@ -610,22 +652,22 @@ scsi_serviceactionin_datain_unmarshall(struct scsi_task *task)
dc245c
 		if (rc16 == NULL) {
dc245c
 			return NULL;
dc245c
 		}
dc245c
-		rc16->returned_lba = scsi_get_uint32(&task->datain.data[0]);
dc245c
-		rc16->returned_lba = (rc16->returned_lba << 32) | scsi_get_uint32(&task->datain.data[4]);
dc245c
-		rc16->block_length = scsi_get_uint32(&task->datain.data[8]);
dc245c
+		rc16->returned_lba = task_get_uint32(task, 0);
dc245c
+		rc16->returned_lba = (rc16->returned_lba << 32) | task_get_uint32(task, 4);
dc245c
+		rc16->block_length = task_get_uint32(task, 8);
dc245c
 		rc16->p_type       = (task->datain.data[12] >> 1) & 0x07;
dc245c
 		rc16->prot_en      = task->datain.data[12] & 0x01;
dc245c
 		rc16->p_i_exp      = (task->datain.data[13] >> 4) & 0x0f;
dc245c
 		rc16->lbppbe       = task->datain.data[13] & 0x0f;
dc245c
 		rc16->lbpme        = !!(task->datain.data[14] & 0x80);
dc245c
 		rc16->lbprz        = !!(task->datain.data[14] & 0x40);
dc245c
-		rc16->lalba        = scsi_get_uint16(&task->datain.data[14]) & 0x3fff;
dc245c
+		rc16->lalba        = task_get_uint16(task, 14) & 0x3fff;
dc245c
 		return rc16;
dc245c
 	}
dc245c
 	case SCSI_GET_LBA_STATUS: {
dc245c
 		struct scsi_get_lba_status *gls = scsi_malloc(task,
dc245c
 							      sizeof(*gls));
dc245c
-		int32_t len = scsi_get_uint32(&task->datain.data[0]);
dc245c
+		int32_t len = task_get_uint32(task, 0);
dc245c
 		int i;
dc245c
 
dc245c
 		if (gls == NULL) {
dc245c
@@ -646,11 +688,11 @@ scsi_serviceactionin_datain_unmarshall(struct scsi_task *task)
dc245c
 		}
dc245c
 
dc245c
 		for (i = 0; i < (int)gls->num_descriptors; i++) {
dc245c
-			gls->descriptors[i].lba  = scsi_get_uint32(&task->datain.data[8 + i * sizeof(struct scsi_lba_status_descriptor) + 0]);
dc245c
+			gls->descriptors[i].lba  = task_get_uint32(task, 8 + i * sizeof(struct scsi_lba_status_descriptor) + 0);
dc245c
 			gls->descriptors[i].lba <<= 32;
dc245c
- 			gls->descriptors[i].lba |= scsi_get_uint32(&task->datain.data[8 + i * sizeof(struct scsi_lba_status_descriptor) + 4]);
dc245c
+ 			gls->descriptors[i].lba |= task_get_uint32(task, 8 + i * sizeof(struct scsi_lba_status_descriptor) + 4);
dc245c
 
dc245c
-			gls->descriptors[i].num_blocks = scsi_get_uint32(&task->datain.data[8 + i * sizeof(struct scsi_lba_status_descriptor) + 8]);
dc245c
+			gls->descriptors[i].num_blocks = task_get_uint32(task, 8 + i * sizeof(struct scsi_lba_status_descriptor) + 8);
dc245c
 
dc245c
 			gls->descriptors[i].provisioning = task->datain.data[8 + i * sizeof(struct scsi_lba_status_descriptor) + 12] & 0x0f;
dc245c
 		}
dc245c
@@ -676,7 +718,7 @@ scsi_persistentreservein_datain_getfullsize(struct scsi_task *task)
dc245c
 {
dc245c
 	switch (scsi_persistentreservein_sa(task)) {
dc245c
 	case SCSI_PERSISTENT_RESERVE_READ_KEYS:
dc245c
-		return scsi_get_uint32(&task->datain.data[4]) + 8;
dc245c
+		return task_get_uint32(task, 4) + 8;
dc245c
 	case SCSI_PERSISTENT_RESERVE_READ_RESERVATION:
dc245c
 		return 8;
dc245c
 	case SCSI_PERSISTENT_RESERVE_REPORT_CAPABILITIES:
dc245c
@@ -696,24 +738,24 @@ scsi_persistentreservein_datain_unmarshall(struct scsi_task *task)
dc245c
 
dc245c
 	switch (scsi_persistentreservein_sa(task)) {
dc245c
 	case SCSI_PERSISTENT_RESERVE_READ_KEYS:
dc245c
-		i = scsi_get_uint32(&task->datain.data[4]);
dc245c
+		i = task_get_uint32(task, 4);
dc245c
 
dc245c
 		rk = scsi_malloc(task, offsetof(struct scsi_persistent_reserve_in_read_keys, keys) + i);
dc245c
 		if (rk == NULL) {
dc245c
 			return NULL;
dc245c
 		}
dc245c
-		rk->prgeneration      = scsi_get_uint32(&task->datain.data[0]);
dc245c
-		rk->additional_length = scsi_get_uint32(&task->datain.data[4]);
dc245c
+		rk->prgeneration      = task_get_uint32(task, 0);
dc245c
+		rk->additional_length = task_get_uint32(task, 4);
dc245c
 
dc245c
 		rk->num_keys = rk->additional_length / 8;
dc245c
 		for (i = 0; i < (int)rk->num_keys; i++) {
dc245c
-			rk->keys[i] = scsi_get_uint64(&task->datain.data[8 + i * 8]);
dc245c
+			rk->keys[i] = task_get_uint64(task, 8 + i * 8);
dc245c
 		}
dc245c
 		return rk;
dc245c
 	case SCSI_PERSISTENT_RESERVE_READ_RESERVATION: {
dc245c
 		size_t	alloc_sz;
dc245c
 
dc245c
-		i = scsi_get_uint32(&task->datain.data[4]);
dc245c
+		i = task_get_uint32(task, 4);
dc245c
 		alloc_sz = offsetof(
dc245c
 			struct scsi_persistent_reserve_in_read_reservation,
dc245c
 			reserved) + i;
dc245c
@@ -723,12 +765,12 @@ scsi_persistentreservein_datain_unmarshall(struct scsi_task *task)
dc245c
 			return NULL;
dc245c
 		}
dc245c
 		memset(rr, 0, alloc_sz);
dc245c
-		rr->prgeneration = scsi_get_uint32(&task->datain.data[0]);
dc245c
+		rr->prgeneration = task_get_uint32(task, 0);
dc245c
 
dc245c
 		if (i > 0) {
dc245c
 			rr->reserved = 1;
dc245c
 			rr->reservation_key =
dc245c
-				scsi_get_uint64(&task->datain.data[8]);
dc245c
+				task_get_uint64(task, 8);
dc245c
 			rr->pr_type = task->datain.data[21] & 0xff;
dc245c
 		}
dc245c
 
dc245c
@@ -739,14 +781,14 @@ scsi_persistentreservein_datain_unmarshall(struct scsi_task *task)
dc245c
 		if (rc == NULL) {
dc245c
 			return NULL;
dc245c
 		}
dc245c
-		rc->length         = scsi_get_uint16(&task->datain.data[0]);
dc245c
+		rc->length         = task_get_uint16(task, 0);
dc245c
 		rc->crh            = !!(task->datain.data[2] & 0x10);
dc245c
 		rc->sip_c          = !!(task->datain.data[2] & 0x08);
dc245c
 		rc->atp_c          = !!(task->datain.data[2] & 0x04);
dc245c
 		rc->ptpl_c         = !!(task->datain.data[2] & 0x01);
dc245c
 		rc->tmv            = !!(task->datain.data[3] & 0x80);
dc245c
 		rc->allow_commands = task->datain.data[3] >> 4;
dc245c
-		rc->persistent_reservation_type_mask = scsi_get_uint16(&task->datain.data[4]);
dc245c
+		rc->persistent_reservation_type_mask = task_get_uint16(task, 4);
dc245c
 
dc245c
 		return rc;
dc245c
 	default:
dc245c
@@ -776,7 +818,7 @@ scsi_maintenancein_datain_getfullsize(struct scsi_task *task)
dc245c
 
dc245c
 	switch (scsi_maintenancein_sa(task)) {
dc245c
 	case SCSI_REPORT_SUPPORTED_OP_CODES:
dc245c
-		return scsi_get_uint32(&task->datain.data[0]) + 4;
dc245c
+		return task_get_uint32(task, 0) + 4;
dc245c
 	default:
dc245c
 		return -1;
dc245c
 	}
dc245c
@@ -799,7 +841,7 @@ scsi_maintenancein_datain_unmarshall(struct scsi_task *task)
dc245c
 			return NULL;
dc245c
 		}
dc245c
 
dc245c
-		len = scsi_get_uint32(&task->datain.data[0]);
dc245c
+		len = task_get_uint32(task, 0);
dc245c
 		rsoc = scsi_malloc(task, sizeof(struct scsi_report_supported_op_codes) + len);
dc245c
 		if (rsoc == NULL) {
dc245c
 			return NULL;
dc245c
@@ -900,8 +942,8 @@ scsi_readcapacity10_datain_unmarshall(struct scsi_task *task)
dc245c
 		return NULL;
dc245c
 	}
dc245c
 
dc245c
-	rc10->lba        = scsi_get_uint32(&task->datain.data[0]);
dc245c
-	rc10->block_size = scsi_get_uint32(&task->datain.data[4]);
dc245c
+	rc10->lba        = task_get_uint32(task, 0);
dc245c
+	rc10->block_size = task_get_uint32(task, 4);
dc245c
 
dc245c
 	return rc10;
dc245c
 }
dc245c
@@ -972,7 +1014,7 @@ scsi_inquiry_datain_getfullsize(struct scsi_task *task)
dc245c
 	case SCSI_INQUIRY_PAGECODE_DEVICE_IDENTIFICATION:
dc245c
 	case SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS:
dc245c
 	case SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING:
dc245c
-		return scsi_get_uint16(&task->datain.data[2]) + 4;
dc245c
+		return task_get_uint16(task, 2) + 4;
dc245c
 	default:
dc245c
 		return -1;
dc245c
 	}
dc245c
@@ -1079,7 +1120,7 @@ scsi_inquiry_unmarshall_device_identification(struct scsi_task *task)
dc245c
 {
dc245c
 	struct scsi_inquiry_device_identification *inq = scsi_malloc(task,
dc245c
 								     sizeof(*inq));
dc245c
-	int remaining = scsi_get_uint16(&task->datain.data[2]);
dc245c
+	int remaining = task_get_uint16(task, 2);
dc245c
 	unsigned char *dptr;
dc245c
 
dc245c
 	if (inq == NULL) {
dc245c
@@ -1148,17 +1189,18 @@ scsi_inquiry_unmarshall_block_limits(struct scsi_task *task)
dc245c
 
dc245c
 	inq->wsnz                  = task->datain.data[4] & 0x01;
dc245c
 	inq->max_cmp               = task->datain.data[5];
dc245c
-	inq->opt_gran              = scsi_get_uint16(&task->datain.data[6]);
dc245c
-	inq->max_xfer_len          = scsi_get_uint32(&task->datain.data[8]);
dc245c
-	inq->opt_xfer_len          = scsi_get_uint32(&task->datain.data[12]);
dc245c
-	inq->max_prefetch          = scsi_get_uint32(&task->datain.data[16]);
dc245c
-	inq->max_unmap             = scsi_get_uint32(&task->datain.data[20]);
dc245c
-	inq->max_unmap_bdc         = scsi_get_uint32(&task->datain.data[24]);
dc245c
-	inq->opt_unmap_gran        = scsi_get_uint32(&task->datain.data[28]);
dc245c
+	inq->opt_gran              = task_get_uint16(task, 6);
dc245c
+	inq->max_xfer_len          = task_get_uint32(task, 8);
dc245c
+	inq->opt_xfer_len          = task_get_uint32(task, 12);
dc245c
+	inq->max_prefetch          = task_get_uint32(task, 16);
dc245c
+	inq->max_unmap             = task_get_uint32(task, 20);
dc245c
+	inq->max_unmap_bdc         = task_get_uint32(task, 24);
dc245c
+	inq->opt_unmap_gran        = task_get_uint32(task, 28);
dc245c
 	inq->ugavalid              = !!(task->datain.data[32]&0x80);
dc245c
-	inq->unmap_gran_align      = scsi_get_uint32(&task->datain.data[32]) & 0x7fffffff;
dc245c
-	inq->max_ws_len            = scsi_get_uint32(&task->datain.data[36]);
dc245c
-	inq->max_ws_len            = (inq->max_ws_len << 32) | scsi_get_uint32(&task->datain.data[40]);
dc245c
+	inq->unmap_gran_align      = task_get_uint32(task, 32) & 0x7fffffff;
dc245c
+	inq->max_ws_len            = task_get_uint32(task, 36);
dc245c
+	inq->max_ws_len            = (inq->max_ws_len << 32)
dc245c
+				   	| task_get_uint32(task, 40);
dc245c
 
dc245c
 	return inq;
dc245c
 }
dc245c
@@ -1175,7 +1217,7 @@ scsi_inquiry_unmarshall_block_device_characteristics(struct scsi_task *task)
dc245c
 	inq->device_type           = task->datain.data[0]&0x1f;
dc245c
 	inq->pagecode              = task->datain.data[1];
dc245c
 
dc245c
-	inq->medium_rotation_rate  = scsi_get_uint16(&task->datain.data[4]);
dc245c
+	inq->medium_rotation_rate  = task_get_uint16(task, 4);
dc245c
 	return inq;
dc245c
 }
dc245c
 
dc245c
@@ -2040,10 +2082,10 @@ scsi_parse_mode_caching(struct scsi_task *task, int pos, struct scsi_mode_page *
dc245c
 	mp->caching.demand_read_retention_priority = (task->datain.data[pos+1] >> 4) & 0x0f;
dc245c
 	mp->caching.write_retention_priority       = task->datain.data[pos+1] & 0x0f;
dc245c
 
dc245c
-	mp->caching.disable_prefetch_transfer_length = scsi_get_uint16(&task->datain.data[pos+2]);
dc245c
-	mp->caching.minimum_prefetch = scsi_get_uint16(&task->datain.data[pos+4]);
dc245c
-	mp->caching.maximum_prefetch = scsi_get_uint16(&task->datain.data[pos+6]);
dc245c
-	mp->caching.maximum_prefetch_ceiling = scsi_get_uint16(&task->datain.data[pos+8]);
dc245c
+	mp->caching.disable_prefetch_transfer_length = task_get_uint16(task, pos + 2);
dc245c
+	mp->caching.minimum_prefetch = task_get_uint16(task, pos + 4);
dc245c
+	mp->caching.maximum_prefetch = task_get_uint16(task, pos + 6);
dc245c
+	mp->caching.maximum_prefetch_ceiling = task_get_uint16(task, pos + 8);
dc245c
 
dc245c
 	mp->caching.fsw    = task->datain.data[pos+10] & 0x80;
dc245c
 	mp->caching.lbcss  = task->datain.data[pos+10] & 0x40;
dc245c
@@ -2051,7 +2093,7 @@ scsi_parse_mode_caching(struct scsi_task *task, int pos, struct scsi_mode_page *
dc245c
 	mp->caching.nv_dis = task->datain.data[pos+10] & 0x01;
dc245c
 
dc245c
 	mp->caching.number_of_cache_segments = task->datain.data[pos+11];
dc245c
-	mp->caching.cache_segment_size = scsi_get_uint16(&task->datain.data[pos+12]);
dc245c
+	mp->caching.cache_segment_size = task_get_uint16(task, pos + 12);
dc245c
 }
dc245c
 
dc245c
 static void
dc245c
@@ -2059,15 +2101,15 @@ scsi_parse_mode_disconnect_reconnect(struct scsi_task *task, int pos, struct scs
dc245c
 {
dc245c
 	mp->disconnect_reconnect.buffer_full_ratio = task->datain.data[pos];
dc245c
 	mp->disconnect_reconnect.buffer_empty_ratio = task->datain.data[pos+1];
dc245c
-	mp->disconnect_reconnect.bus_inactivity_limit = scsi_get_uint16(&task->datain.data[pos+2]);
dc245c
-	mp->disconnect_reconnect.disconnect_time_limit = scsi_get_uint16(&task->datain.data[pos+4]);
dc245c
-	mp->disconnect_reconnect.connect_time_limit = scsi_get_uint16(&task->datain.data[pos+6]);
dc245c
-	mp->disconnect_reconnect.maximum_burst_size = scsi_get_uint16(&task->datain.data[pos+8]);
dc245c
+	mp->disconnect_reconnect.bus_inactivity_limit = task_get_uint16(task, pos + 2);
dc245c
+	mp->disconnect_reconnect.disconnect_time_limit = task_get_uint16(task, pos + 4);
dc245c
+	mp->disconnect_reconnect.connect_time_limit = task_get_uint16(task, pos + 6);
dc245c
+	mp->disconnect_reconnect.maximum_burst_size = task_get_uint16(task, pos + 8);
dc245c
 	mp->disconnect_reconnect.emdp = task->datain.data[pos+10] & 0x80;
dc245c
 	mp->disconnect_reconnect.fair_arbitration = (task->datain.data[pos+10]>>4) & 0x0f;
dc245c
 	mp->disconnect_reconnect.dimm = task->datain.data[pos+10] & 0x08;
dc245c
 	mp->disconnect_reconnect.dtdc = task->datain.data[pos+10] & 0x07;
dc245c
-	mp->disconnect_reconnect.first_burst_size = scsi_get_uint16(&task->datain.data[pos+12]);
dc245c
+	mp->disconnect_reconnect.first_burst_size = task_get_uint16(task, pos + 12);
dc245c
 }
dc245c
 
dc245c
 static void
dc245c
@@ -2081,8 +2123,8 @@ scsi_parse_mode_informational_exceptions_control(struct scsi_task *task, int pos
dc245c
 	mp->iec.ebackerr       = task->datain.data[pos] & 0x02;
dc245c
 	mp->iec.logerr         = task->datain.data[pos] & 0x01;
dc245c
 	mp->iec.mrie           = task->datain.data[pos+1] & 0x0f;
dc245c
-	mp->iec.interval_timer = scsi_get_uint32(&task->datain.data[pos+2]);
dc245c
-	mp->iec.report_count   = scsi_get_uint32(&task->datain.data[pos+6]);
dc245c
+	mp->iec.interval_timer = task_get_uint32(task, pos + 2);
dc245c
+	mp->iec.report_count   = task_get_uint32(task, pos + 6);
dc245c
 }
dc245c
 
dc245c
 
dc245c
@@ -2129,7 +2171,7 @@ scsi_modesense_datain_unmarshall(struct scsi_task *task)
dc245c
 
dc245c
 		if (mp->spf) {
dc245c
 			mp->subpage_code = task->datain.data[pos++];
dc245c
-			mp->len = scsi_get_uint16(&task->datain.data[pos]);
dc245c
+			mp->len = task_get_uint16(task, pos);
dc245c
 			pos += 2;
dc245c
 		} else {
dc245c
 			mp->subpage_code = 0;
dc245c
-- 
dc245c
1.8.1.4
dc245c