aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi/scsi_error.c
diff options
context:
space:
mode:
authorMike Christie <michaelc@cs.wisc.edu>2006-08-26 03:00:22 -0400
committerJames Bottomley <jejb@mulgrave.il.steeleye.com>2006-08-26 11:03:14 -0400
commit0db99e3359234be181590463184b9959059a9ea9 (patch)
tree3822a0e4c6408cd0f0d23211f7f969dae873b483 /drivers/scsi/scsi_error.c
parent15a3758dc9e1c9d862e46acdf607de70c302fa6a (diff)
[SCSI] fix scsi_send_eh_cmnd regression
The callers of scsi_send_eh_cmnd are setting the cmnd buffer, and then scsi_send_eh_cmnd is copying that updated buffer to the old_cmnd variable. Then after the command runs, we end up copying that old_cmnd var which has the new cmnd to the scsi command buffer. When this command gets recent, all types of fun things happen like getting TUR or START_STOP commands with data and scatterlists. This patch made against scsi-rc-fixes, has the callers of scsi_send_eh_cmnd pass in the command so scsi_send_eh_cmnd can do the right thing. This should go into 2.6.18 since this fixes a regression added when we removed some of the scsi_cmnd fields and replaced them with local variables. Signed-off-by: Mike Christie <michaelc@cs.wisc.edu> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Diffstat (limited to 'drivers/scsi/scsi_error.c')
-rw-r--r--drivers/scsi/scsi_error.c18
1 files changed, 9 insertions, 9 deletions
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 6a5b731bd5ba..a8ed5a22009d 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -460,7 +460,8 @@ static void scsi_eh_done(struct scsi_cmnd *scmd)
460 * Return value: 460 * Return value:
461 * SUCCESS or FAILED or NEEDS_RETRY 461 * SUCCESS or FAILED or NEEDS_RETRY
462 **/ 462 **/
463static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout, int copy_sense) 463static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigned char *cmnd,
464 int cmnd_size, int timeout, int copy_sense)
464{ 465{
465 struct scsi_device *sdev = scmd->device; 466 struct scsi_device *sdev = scmd->device;
466 struct Scsi_Host *shost = sdev->host; 467 struct Scsi_Host *shost = sdev->host;
@@ -490,6 +491,9 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout, int copy_sense
490 old_cmd_len = scmd->cmd_len; 491 old_cmd_len = scmd->cmd_len;
491 old_use_sg = scmd->use_sg; 492 old_use_sg = scmd->use_sg;
492 493
494 memset(scmd->cmnd, 0, sizeof(scmd->cmnd));
495 memcpy(scmd->cmnd, cmnd, cmnd_size);
496
493 if (copy_sense) { 497 if (copy_sense) {
494 int gfp_mask = GFP_ATOMIC; 498 int gfp_mask = GFP_ATOMIC;
495 499
@@ -610,8 +614,7 @@ static int scsi_request_sense(struct scsi_cmnd *scmd)
610 static unsigned char generic_sense[6] = 614 static unsigned char generic_sense[6] =
611 {REQUEST_SENSE, 0, 0, 0, 252, 0}; 615 {REQUEST_SENSE, 0, 0, 0, 252, 0};
612 616
613 memcpy(scmd->cmnd, generic_sense, sizeof(generic_sense)); 617 return scsi_send_eh_cmnd(scmd, generic_sense, 6, SENSE_TIMEOUT, 1);
614 return scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 1);
615} 618}
616 619
617/** 620/**
@@ -736,10 +739,7 @@ static int scsi_eh_tur(struct scsi_cmnd *scmd)
736 int retry_cnt = 1, rtn; 739 int retry_cnt = 1, rtn;
737 740
738retry_tur: 741retry_tur:
739 memcpy(scmd->cmnd, tur_command, sizeof(tur_command)); 742 rtn = scsi_send_eh_cmnd(scmd, tur_command, 6, SENSE_TIMEOUT, 0);
740
741
742 rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 0);
743 743
744 SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n", 744 SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
745 __FUNCTION__, scmd, rtn)); 745 __FUNCTION__, scmd, rtn));
@@ -839,8 +839,8 @@ static int scsi_eh_try_stu(struct scsi_cmnd *scmd)
839 if (scmd->device->allow_restart) { 839 if (scmd->device->allow_restart) {
840 int rtn; 840 int rtn;
841 841
842 memcpy(scmd->cmnd, stu_command, sizeof(stu_command)); 842 rtn = scsi_send_eh_cmnd(scmd, stu_command, 6,
843 rtn = scsi_send_eh_cmnd(scmd, START_UNIT_TIMEOUT, 0); 843 START_UNIT_TIMEOUT, 0);
844 if (rtn == SUCCESS) 844 if (rtn == SUCCESS)
845 return 0; 845 return 0;
846 } 846 }