diff options
author | Alan Stern <stern@rowland.harvard.edu> | 2008-06-24 14:03:14 -0400 |
---|---|---|
committer | James Bottomley <James.Bottomley@HansenPartnership.com> | 2008-07-06 12:33:08 -0400 |
commit | bdb2b8cab4392ce41ddfbd6773a3da3334daf836 (patch) | |
tree | 1d7804a10bc8af816af41a2e7d1ce73f9e0e72d3 /drivers | |
parent | b7279469d66b55119784b8b9529c99c1955fe747 (diff) |
[SCSI] erase invalid data returned by device
This patch (as1108) fixes a problem that can occur with certain USB
mass-storage devices: They return invalid data together with a residue
indicating that the data should be ignored. Rather than leave the
invalid data in a transfer buffer, where it can get misinterpreted,
the patch clears the invalid portion of the buffer.
This solves a problem (wrong write-protect setting detected) reported
by Maciej Rutecki and Peter Teoh.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Peter Teoh <htmldeveloper@gmail.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/scsi/scsi_lib.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index a82d2fe80fb..cbf55d59a54 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c | |||
@@ -207,6 +207,15 @@ int scsi_execute(struct scsi_device *sdev, const unsigned char *cmd, | |||
207 | */ | 207 | */ |
208 | blk_execute_rq(req->q, NULL, req, 1); | 208 | blk_execute_rq(req->q, NULL, req, 1); |
209 | 209 | ||
210 | /* | ||
211 | * Some devices (USB mass-storage in particular) may transfer | ||
212 | * garbage data together with a residue indicating that the data | ||
213 | * is invalid. Prevent the garbage from being misinterpreted | ||
214 | * and prevent security leaks by zeroing out the excess data. | ||
215 | */ | ||
216 | if (unlikely(req->data_len > 0 && req->data_len <= bufflen)) | ||
217 | memset(buffer + (bufflen - req->data_len), 0, req->data_len); | ||
218 | |||
210 | ret = req->errors; | 219 | ret = req->errors; |
211 | out: | 220 | out: |
212 | blk_put_request(req); | 221 | blk_put_request(req); |