Commit f342aeef authored by James Bottomley's avatar James Bottomley Committed by James Bottomley

AUTOSENSE bug in NCR5380.c

From: 	Kenn Humborg <kenn@linux.ie>

round line 2470 in NCR5380.c, if a command fails, and AUTOSENSE is on,
the current command is converted into a REQUEST_SENSE command and
put at the top of the request queue.  Part of this setup, is setting
up cmd->SCp to point at the sense_buffer, so that the received sense
data goes straight into the sense buffer.

Around line 1730, NCR5380_select() calls initialize_SCp() which ends
up clobbering cmd->SCp, and the sense data get written into the 
original request buffer.

This is what happens if cmd->use_sg = 0.  I haven't looked at what
happens if use_sg is non-zero, but I expect the effect will be the same.
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent 3df8ac46
...@@ -1720,8 +1720,9 @@ static int NCR5380_select(struct Scsi_Host *instance, Scsi_Cmnd * cmd, int tag) ...@@ -1720,8 +1720,9 @@ static int NCR5380_select(struct Scsi_Host *instance, Scsi_Cmnd * cmd, int tag)
hostdata->connected = cmd; hostdata->connected = cmd;
hostdata->busy[cmd->device->id] |= (1 << cmd->device->lun); hostdata->busy[cmd->device->id] |= (1 << cmd->device->lun);
initialize_SCp(cmd); if (cmd->SCp.ptr != (char *)cmd->sense_buffer) {
initialize_SCp(cmd);
}
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment