Commit d82113e1 authored by Dann Frazier's avatar Dann Frazier

add missing patch, thx maks

svn path=/dists/etch/linux-2.6/; revision=8561
parent f3970f0b
From: Joerg Dorchain <>
Date: Tue, 6 Mar 2007 10:46:54 +0000 (-0800)
Subject: [SCSI] gdth: fix oops in gdth_copy_cmd()
X-Git-Tag: v2.6.21~211^2
[SCSI] gdth: fix oops in gdth_copy_cmd()
Recent alterations to the gdth_fill_raw_cmd() path no longer set the
sg_ranz field for zero transfer commands. However, this field is used
lower down in the function to initialise ha->cmd_len to the size of
the firmware packet. If this uninitialised field contains a bogus
value, ha->cmd_len can become much larger than the actual firmware
packet and end up oopsing in gdth_copy_cmd() as it tries to copy this
huge packet to the device (usually because it runs into an unallocated
The fix is to initialise the sg_ranz field to zero at the start of
Signed-off-by: Joerg Dorchain <>
Acked-by: "Leubner, Achim" <>
Signed-off-by: Andrew Morton <>
Signed-off-by: James Bottomley <>
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 8c81cec..60446b8 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -3091,6 +3091,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
cmdp->u.raw64.direction =
gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
+ cmdp->u.raw64.sg_ranz = 0;
} else {
cmdp->u.raw.reserved = 0;
cmdp->u.raw.mdisc_time = 0;
@@ -3107,6 +3108,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
cmdp->u.raw.direction =
gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
+ cmdp->u.raw.sg_ranz = 0;
if (scp->use_sg) {
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment