diff options
| author | Dan Williams <dan.j.williams@intel.com> | 2011-06-15 11:11:03 -0700 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2011-07-03 04:04:51 -0700 |
| commit | 360b03ed178a4fe3971b0a098d8feeb53333481b (patch) | |
| tree | 4641e9eb68e1e027aa089e4a21c862c1170ca056 /drivers | |
| parent | 0d0cf14c9bd2943ed5afd15df459f564d85eacde (diff) | |
| download | linux-360b03ed178a4fe3971b0a098d8feeb53333481b.tar.bz2 | |
isci: fix ssp response iu buffer size in isci_tmf
In isci_task_request_complete() we save the response/sense data from the
command. Make sure isci_tmf has enough space to hold the full response.
[ it does not look like we actually use this data, and
response_data_len/sense_data_len should be specifying the byte count,
in any event do the simple fix first so we don't corrupt memory ]
Reported-by: Adam Gruchala <adam.gruchala@intel.com>
Tested-by: Edmund Nadolski <edmund.nadolski@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/scsi/isci/task.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/scsi/isci/task.h b/drivers/scsi/isci/task.h index c8dd075d2be2..d574a18956d7 100644 --- a/drivers/scsi/isci/task.h +++ b/drivers/scsi/isci/task.h @@ -100,7 +100,8 @@ struct isci_tmf { union { struct ssp_response_iu resp_iu; struct dev_to_host_fis d2h_fis; - } resp; + u8 rsp_buf[SSP_RESP_IU_MAX_SIZE]; + } resp; unsigned char lun[8]; u16 io_tag; struct isci_remote_device *device; |