Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  firewire: prevent userspace from accessing shut down devices
  ieee1394: sbp2: use correct size of command descriptor block

1 files changed, 8 insertions, 12 deletions

diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 16b9d0ad154e..a5ceff287a28 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -1539,15 +1539,13 @@ static void sbp2_prep_command_orb_sg(struct sbp2_command_orb *orb,
 
 static void sbp2_create_command_orb(struct sbp2_lu *lu,
                                     struct sbp2_command_info *cmd,
-                                    unchar *scsi_cmd,
-                                    unsigned int scsi_use_sg,
-                                    unsigned int scsi_request_bufflen,
-                                    struct scatterlist *sg,
-                                    enum dma_data_direction dma_dir)
+                                    struct scsi_cmnd *SCpnt)
 {
         struct sbp2_fwhost_info *hi = lu->hi;
         struct sbp2_command_orb *orb = &cmd->command_orb;
         u32 orb_direction;
+        unsigned int scsi_request_bufflen = scsi_bufflen(SCpnt);
+        enum dma_data_direction dma_dir = SCpnt->sc_data_direction;
 
         /*
          * Set-up our command ORB.
@@ -1580,13 +1578,14 @@ static void sbp2_create_command_orb(struct sbp2_lu *lu,
                 orb->data_descriptor_lo = 0x0;
                 orb->misc |= ORB_SET_DIRECTION(1);
         } else
-                sbp2_prep_command_orb_sg(orb, hi, cmd, scsi_use_sg, sg,
+                sbp2_prep_command_orb_sg(orb, hi, cmd, scsi_sg_count(SCpnt),
+                                         scsi_sglist(SCpnt),
                                          orb_direction, dma_dir);
 
         sbp2util_cpu_to_be32_buffer(orb, sizeof(*orb));
 
-        memset(orb->cdb, 0, 12);
-        memcpy(orb->cdb, scsi_cmd, COMMAND_SIZE(*scsi_cmd));
+        memset(orb->cdb, 0, sizeof(orb->cdb));
+        memcpy(orb->cdb, SCpnt->cmnd, SCpnt->cmd_len);
 }
 
 static void sbp2_link_orb_command(struct sbp2_lu *lu,
@@ -1669,16 +1668,13 @@ static void sbp2_link_orb_command(struct sbp2_lu *lu,
 static int sbp2_send_command(struct sbp2_lu *lu, struct scsi_cmnd *SCpnt,
                              void (*done)(struct scsi_cmnd *))
 {
-        unchar *scsi_cmd = (unchar *)SCpnt->cmnd;
         struct sbp2_command_info *cmd;
 
         cmd = sbp2util_allocate_command_orb(lu, SCpnt, done);
         if (!cmd)
                 return -EIO;
 
-        sbp2_create_command_orb(lu, cmd, scsi_cmd, scsi_sg_count(SCpnt),
-                                scsi_bufflen(SCpnt), scsi_sglist(SCpnt),
-                                SCpnt->sc_data_direction);
+        sbp2_create_command_orb(lu, cmd, SCpnt);
         sbp2_link_orb_command(lu, cmd);
 
         return 0;