Blame SOURCES/smartmontools-7.0-cciss-smallbuf-segfault.patch

27463b
Index: cciss.cpp
27463b
===================================================================
27463b
--- a/cciss.cpp	(revision 4975)
27463b
+++ a/cciss.cpp	(working copy)
27463b
@@ -71,10 +71,12 @@
27463b
 */
27463b
 int cciss_io_interface(int device, int target, struct scsi_cmnd_io * iop, int report)
27463b
 {
27463b
-     unsigned char pBuf[512] = {0};
27463b
+     switch (iop->dxfer_dir) {
27463b
+        case DXFER_NONE: case DXFER_FROM_DEVICE: break;
27463b
+        default: return -ENOTSUP; // TODO: Support DXFER_TO_DEVICE
27463b
+     }
27463b
+
27463b
      unsigned char phylun[8] = {0};
27463b
-     int iBufLen = 512;
27463b
-     int len = 0; // used later in the code.
27463b
  
27463b
      int status = cciss_getlun(device, target, phylun, report);
27463b
      if (report > 0)
27463b
@@ -85,6 +87,10 @@
27463b
          return -ENXIO;      /* give up, assume no device there */
27463b
      }
27463b
 
27463b
+     unsigned char sensebuf[SEND_IOCTL_RESP_SENSE_LEN];
27463b
+     unsigned char * pBuf = (iop->dxferp ? iop->dxferp : sensebuf);
27463b
+     unsigned iBufLen = (iop->dxferp ? iop->dxfer_len : sizeof(sensebuf));
27463b
+
27463b
      status = cciss_sendpassthru( 2, iop->cmnd, iop->cmnd_len, (char*) pBuf, iBufLen, 1, phylun, device);
27463b
  
27463b
      if (0 == status)
27463b
@@ -93,7 +99,6 @@
27463b
              printf("  status=0\n");
27463b
          if (DXFER_FROM_DEVICE == iop->dxfer_dir)
27463b
          {
27463b
-             memcpy(iop->dxferp, pBuf, iop->dxfer_len);
27463b
              if (report > 1)
27463b
              {
27463b
                  int trunc = (iop->dxfer_len > 256) ? 1 : 0;
27463b
@@ -107,13 +112,15 @@
27463b
      iop->scsi_status = status & 0x7e; /* bits 0 and 7 used to be for vendors */
27463b
      if (LSCSI_DRIVER_SENSE == ((status >> 24) & 0xf))
27463b
          iop->scsi_status = SCSI_STATUS_CHECK_CONDITION;
27463b
-     len = (SEND_IOCTL_RESP_SENSE_LEN < iop->max_sense_len) ?
27463b
-                SEND_IOCTL_RESP_SENSE_LEN : iop->max_sense_len;
27463b
+     unsigned len = (SEND_IOCTL_RESP_SENSE_LEN < iop->max_sense_len) ?
27463b
+                     SEND_IOCTL_RESP_SENSE_LEN : iop->max_sense_len;
27463b
+     if (len > iBufLen)
27463b
+       len = iBufLen;
27463b
      if ((SCSI_STATUS_CHECK_CONDITION == iop->scsi_status) &&
27463b
          iop->sensep && (len > 0))
27463b
      {
27463b
          memcpy(iop->sensep, pBuf, len);
27463b
-         iop->resp_sense_len = iBufLen;
27463b
+         iop->resp_sense_len = len;
27463b
          if (report > 1)
27463b
          {
27463b
              printf("  >>> Sense buffer, len=%d:\n", (int)len);
27463b
@@ -173,7 +180,7 @@
27463b
     iocommand.Request.CDBLen = CDBlen;
27463b
     iocommand.Request.Type.Type = TYPE_CMD;
27463b
     iocommand.Request.Type.Attribute = ATTR_SIMPLE;
27463b
-    iocommand.Request.Type.Direction = XFER_READ;
27463b
+    iocommand.Request.Type.Direction = XFER_READ; // TODO: OK for DXFER_NONE ?
27463b
     iocommand.Request.Timeout = 0;
27463b
 
27463b
     iocommand.buf_size = size;