Commit fe42b05a authored by Ben Collins's avatar Ben Collins
Browse files

sbp2: remove manipulation of inquiry response 



This code became ineffective a few Linux releases ago and is not
required anyway.

Note from Christoph Hellwig: scsi_cmnd.request_buffer is always a
scatterlist these days.  Checking random bites into it and then
mangling the data in sbp2_check_sbp2_response will cause really bad
memory corruption when you're not lucky enough to have the check not
trigger by luck.

Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: default avatarBen Collins <bcollins@ubuntu.com>
parent eaf88450

drivers/ieee1394/sbp2.c

+0 −34
Original line number Diff line number Diff line
@@ -2111,33 +2111,6 @@ static unsigned int sbp2_status_to_sense_data(unchar *sbp2_status, unchar *sense 
	return sbp2_status[8] & 0x3f;	/* return scsi status */

}



/*

 * This function is called after a command is completed, in order to do any necessary SBP-2

 * response data translations for the SCSI stack

 */

static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,

				     struct scsi_cmnd *SCpnt)

{

	u8 *scsi_buf = SCpnt->request_buffer;



	SBP2_DEBUG_ENTER();



	if (SCpnt->cmnd[0] == INQUIRY && (SCpnt->cmnd[1] & 3) == 0) {

		/*

		 * Make sure data length is ok. Minimum length is 36 bytes

		 */

		if (scsi_buf[4] == 0) {

			scsi_buf[4] = 36 - 5;

		}



		/*

		 * Fix ansi revision and response data format

		 */

		scsi_buf[2] |= 2;

		scsi_buf[3] = (scsi_buf[3] & 0xf0) | 2;

	}

}



/*

 * This function deals with status writes from the SBP-2 device

 */
@@ -2476,13 +2449,6 @@ static void sbp2scsi_complete_command(struct scsi_id_instance_data *scsi_id, 
		SCpnt->result = DID_ERROR << 16;

	}



	/*

	 * Take care of any sbp2 response data mucking here (RBC stuff, etc.)

	 */

	if (SCpnt->result == DID_OK << 16) {

		sbp2_check_sbp2_response(scsi_id, SCpnt);

	}



	/*

	 * If a bus reset is in progress and there was an error, complete

	 * the command as busy so that it will get retried.

drivers/ieee1394/sbp2.h

+2 −3
Original line number Diff line number Diff line
@@ -395,9 +395,8 @@ static int sbp2_link_orb_command(struct scsi_id_instance_data *scsi_id, 
static int sbp2_send_command(struct scsi_id_instance_data *scsi_id,

			     struct scsi_cmnd *SCpnt,

			     void (*done)(struct scsi_cmnd *));

static unsigned int sbp2_status_to_sense_data(unchar *sbp2_status, unchar *sense_data);

static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,

				     struct scsi_cmnd *SCpnt);

static unsigned int sbp2_status_to_sense_data(unchar *sbp2_status,

					      unchar *sense_data);

static void sbp2_parse_unit_directory(struct scsi_id_instance_data *scsi_id,

				      struct unit_directory *ud);

static int sbp2_set_busy_timeout(struct scsi_id_instance_data *scsi_id);

CRA Git | Maintained and supported by SUSTech CRA and CCSE