aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/scsi/scsi_lib.c
diff options
context:
space:
mode:
authorAlan Stern <stern@rowland.harvard.edu>2008-06-24 14:03:14 -0400
committerJames Bottomley <James.Bottomley@HansenPartnership.com>2008-07-06 12:33:08 -0400
commitbdb2b8cab4392ce41ddfbd6773a3da3334daf836 (patch)
tree1d7804a10bc8af816af41a2e7d1ce73f9e0e72d3 /drivers/scsi/scsi_lib.c
parentb7279469d66b55119784b8b9529c99c1955fe747 (diff)
[SCSI] erase invalid data returned by device
This patch (as1108) fixes a problem that can occur with certain USB mass-storage devices: They return invalid data together with a residue indicating that the data should be ignored. Rather than leave the invalid data in a transfer buffer, where it can get misinterpreted, the patch clears the invalid portion of the buffer. This solves a problem (wrong write-protect setting detected) reported by Maciej Rutecki and Peter Teoh. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Peter Teoh <htmldeveloper@gmail.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Diffstat (limited to 'drivers/scsi/scsi_lib.c')
-rw-r--r--drivers/scsi/scsi_lib.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index a82d2fe80fb5..cbf55d59a54c 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -207,6 +207,15 @@ int scsi_execute(struct scsi_device *sdev, const unsigned char *cmd,
207 */ 207 */
208 blk_execute_rq(req->q, NULL, req, 1); 208 blk_execute_rq(req->q, NULL, req, 1);
209 209
210 /*
211 * Some devices (USB mass-storage in particular) may transfer
212 * garbage data together with a residue indicating that the data
213 * is invalid. Prevent the garbage from being misinterpreted
214 * and prevent security leaks by zeroing out the excess data.
215 */
216 if (unlikely(req->data_len > 0 && req->data_len <= bufflen))
217 memset(buffer + (bufflen - req->data_len), 0, req->data_len);
218
210 ret = req->errors; 219 ret = req->errors;
211 out: 220 out:
212 blk_put_request(req); 221 blk_put_request(req);