diff options
| author |   Linus Torvalds <torvalds@linux-foundation.org> | 2012-07-11 12:51:58 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-07-11 12:51:58 -0700 |
| commit | 5f8ebd36f7dd95ec97aec82d5907522dc54e85ba (patch) | |
| tree | a7e06eea7e285b88ae9c7bb03b0b036b52d0ee03 /include | |
| parent | media: mx2_camera: Fix mbus format handling (diff) | |
| parent | [SCSI] bnx2i: Removed the reference to the netdev->base_addr (diff) | |
| download | linux-dev-5f8ebd36f7dd95ec97aec82d5907522dc54e85ba.tar.xz linux-dev-5f8ebd36f7dd95ec97aec82d5907522dc54e85ba.zip | |
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"This is a set of three fixes for data corruption (libsas task file),
oops causing (NULL in scsi_cmd_to_driver) and driver failure (bnx2i).
The oops caused by the NULL in scsi_cmd_to_driver() manifests in
scsi_eh_send_cmd() and has been seen by several people now.
Signed-off-by: James Bottomley <JBottomley@Parallels.com>"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
[SCSI] bnx2i: Removed the reference to the netdev->base_addr
[SCSI] libsas: fix taskfile corruption in sas_ata_qc_fill_rtf
[SCSI] Fix NULL dereferences in scsi_cmd_to_driver
Diffstat (limited to 'include')
| -rw-r--r-- | include/scsi/libsas.h | 6 | ||||
| -rw-r--r-- | include/scsi/scsi_cmnd.h | 8 |
2 files changed, 11 insertions, 3 deletions
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h index f4f1c96dca72..10ce74f589c5 100644 --- a/include/scsi/libsas.h +++ b/include/scsi/libsas.h @@ -163,6 +163,8 @@ enum ata_command_set { ATAPI_COMMAND_SET = 1, }; +#define ATA_RESP_FIS_SIZE 24 + struct sata_device { enum ata_command_set command_set; struct smp_resp rps_resp; /* report_phy_sata_resp */ @@ -171,7 +173,7 @@ struct sata_device { struct ata_port *ap; struct ata_host ata_host; - struct ata_taskfile tf; + u8 fis[ATA_RESP_FIS_SIZE]; }; enum { @@ -537,7 +539,7 @@ enum exec_status { */ struct ata_task_resp { u16 frame_len; - u8 ending_fis[24]; /* dev to host or data-in */ + u8 ending_fis[ATA_RESP_FIS_SIZE]; /* dev to host or data-in */ }; #define SAS_STATUS_BUF_SIZE 96 diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h index 1e1198546c72..ac06cc595890 100644 --- a/include/scsi/scsi_cmnd.h +++ b/include/scsi/scsi_cmnd.h @@ -134,10 +134,16 @@ struct scsi_cmnd { static inline struct scsi_driver *scsi_cmd_to_driver(struct scsi_cmnd *cmd) { + struct scsi_driver **sdp; + if (!cmd->request->rq_disk) return NULL; - return *(struct scsi_driver **)cmd->request->rq_disk->private_data; + sdp = (struct scsi_driver **)cmd->request->rq_disk->private_data; + if (!sdp) + return NULL; + + return *sdp; } extern struct scsi_cmnd *scsi_get_command(struct scsi_device *, gfp_t); |