diff options
author | Mike Christie <michaelc@cs.wisc.edu> | 2006-08-26 03:00:22 -0400 |
---|---|---|
committer | James Bottomley <jejb@mulgrave.il.steeleye.com> | 2006-08-26 11:03:14 -0400 |
commit | 0db99e3359234be181590463184b9959059a9ea9 (patch) | |
tree | 3822a0e4c6408cd0f0d23211f7f969dae873b483 /drivers/scsi/scsi_error.c | |
parent | 15a3758dc9e1c9d862e46acdf607de70c302fa6a (diff) |
[SCSI] fix scsi_send_eh_cmnd regression
The callers of scsi_send_eh_cmnd are setting the cmnd buffer,
and then scsi_send_eh_cmnd is copying that updated buffer to
the old_cmnd variable. Then after the command runs, we end up
copying that old_cmnd var which has the new cmnd to the scsi
command buffer. When this command gets recent, all types of fun
things happen like getting TUR or START_STOP commands with
data and scatterlists.
This patch made against scsi-rc-fixes, has the callers of
scsi_send_eh_cmnd pass in the command so scsi_send_eh_cmnd
can do the right thing. This should go into 2.6.18 since this
fixes a regression added when we removed some of the scsi_cmnd
fields and replaced them with local variables.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Diffstat (limited to 'drivers/scsi/scsi_error.c')
-rw-r--r-- | drivers/scsi/scsi_error.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index 6a5b731bd5ba..a8ed5a22009d 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c | |||
@@ -460,7 +460,8 @@ static void scsi_eh_done(struct scsi_cmnd *scmd) | |||
460 | * Return value: | 460 | * Return value: |
461 | * SUCCESS or FAILED or NEEDS_RETRY | 461 | * SUCCESS or FAILED or NEEDS_RETRY |
462 | **/ | 462 | **/ |
463 | static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout, int copy_sense) | 463 | static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigned char *cmnd, |
464 | int cmnd_size, int timeout, int copy_sense) | ||
464 | { | 465 | { |
465 | struct scsi_device *sdev = scmd->device; | 466 | struct scsi_device *sdev = scmd->device; |
466 | struct Scsi_Host *shost = sdev->host; | 467 | struct Scsi_Host *shost = sdev->host; |
@@ -490,6 +491,9 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, int timeout, int copy_sense | |||
490 | old_cmd_len = scmd->cmd_len; | 491 | old_cmd_len = scmd->cmd_len; |
491 | old_use_sg = scmd->use_sg; | 492 | old_use_sg = scmd->use_sg; |
492 | 493 | ||
494 | memset(scmd->cmnd, 0, sizeof(scmd->cmnd)); | ||
495 | memcpy(scmd->cmnd, cmnd, cmnd_size); | ||
496 | |||
493 | if (copy_sense) { | 497 | if (copy_sense) { |
494 | int gfp_mask = GFP_ATOMIC; | 498 | int gfp_mask = GFP_ATOMIC; |
495 | 499 | ||
@@ -610,8 +614,7 @@ static int scsi_request_sense(struct scsi_cmnd *scmd) | |||
610 | static unsigned char generic_sense[6] = | 614 | static unsigned char generic_sense[6] = |
611 | {REQUEST_SENSE, 0, 0, 0, 252, 0}; | 615 | {REQUEST_SENSE, 0, 0, 0, 252, 0}; |
612 | 616 | ||
613 | memcpy(scmd->cmnd, generic_sense, sizeof(generic_sense)); | 617 | return scsi_send_eh_cmnd(scmd, generic_sense, 6, SENSE_TIMEOUT, 1); |
614 | return scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 1); | ||
615 | } | 618 | } |
616 | 619 | ||
617 | /** | 620 | /** |
@@ -736,10 +739,7 @@ static int scsi_eh_tur(struct scsi_cmnd *scmd) | |||
736 | int retry_cnt = 1, rtn; | 739 | int retry_cnt = 1, rtn; |
737 | 740 | ||
738 | retry_tur: | 741 | retry_tur: |
739 | memcpy(scmd->cmnd, tur_command, sizeof(tur_command)); | 742 | rtn = scsi_send_eh_cmnd(scmd, tur_command, 6, SENSE_TIMEOUT, 0); |
740 | |||
741 | |||
742 | rtn = scsi_send_eh_cmnd(scmd, SENSE_TIMEOUT, 0); | ||
743 | 743 | ||
744 | SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n", | 744 | SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n", |
745 | __FUNCTION__, scmd, rtn)); | 745 | __FUNCTION__, scmd, rtn)); |
@@ -839,8 +839,8 @@ static int scsi_eh_try_stu(struct scsi_cmnd *scmd) | |||
839 | if (scmd->device->allow_restart) { | 839 | if (scmd->device->allow_restart) { |
840 | int rtn; | 840 | int rtn; |
841 | 841 | ||
842 | memcpy(scmd->cmnd, stu_command, sizeof(stu_command)); | 842 | rtn = scsi_send_eh_cmnd(scmd, stu_command, 6, |
843 | rtn = scsi_send_eh_cmnd(scmd, START_UNIT_TIMEOUT, 0); | 843 | START_UNIT_TIMEOUT, 0); |
844 | if (rtn == SUCCESS) | 844 | if (rtn == SUCCESS) |
845 | return 0; | 845 | return 0; |
846 | } | 846 | } |