1 files changed, 34 insertions, 3 deletions

diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index a24d3461fc78..31d05ab0b2fc 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -397,6 +397,32 @@ void scsi_target_reap(struct scsi_target *starget)
 }
 
 /**
+ * sanitize_inquiry_string - remove non-graphical chars from an INQUIRY result string
+ * @s: INQUIRY result string to sanitize
+ * @len: length of the string
+ *
+ * Description:
+ *      The SCSI spec says that INQUIRY vendor, product, and revision
+ *      strings must consist entirely of graphic ASCII characters,
+ *      padded on the right with spaces.  Since not all devices obey
+ *      this rule, we will replace non-graphic or non-ASCII characters
+ *      with spaces.  Exception: a NUL character is interpreted as a
+ *      string terminator, so all the following characters are set to
+ *      spaces.
+ **/
+static void sanitize_inquiry_string(unsigned char *s, int len)
+{
+        int terminated = 0;
+
+        for (; len > 0; (--len, ++s)) {
+                if (*s == 0)
+                        terminated = 1;
+                if (terminated || *s < 0x20 || *s > 0x7e)
+                        *s = ' ';
+        }
+}
+
+/**
  * scsi_probe_lun - probe a single LUN using a SCSI INQUIRY
  * @sdev:       scsi_device to probe
  * @inq_result: area to store the INQUIRY result
@@ -410,7 +436,7 @@ void scsi_target_reap(struct scsi_target *starget)
  *     INQUIRY data is in @inq_result; the scsi_level and INQUIRY length
  *     are copied to the scsi_device any flags value is stored in *@bflags.
  **/
-static int scsi_probe_lun(struct scsi_device *sdev, char *inq_result,
+static int scsi_probe_lun(struct scsi_device *sdev, unsigned char *inq_result,
                           int result_len, int *bflags)
 {
         unsigned char scsi_cmd[MAX_COMMAND_SIZE];
@@ -469,7 +495,11 @@ static int scsi_probe_lun(struct scsi_device *sdev, char *inq_result,
         }
 
         if (result == 0) {
-                response_len = (unsigned char) inq_result[4] + 5;
+                sanitize_inquiry_string(&inq_result[8], 8);
+                sanitize_inquiry_string(&inq_result[16], 16);
+                sanitize_inquiry_string(&inq_result[32], 4);
+
+                response_len = inq_result[4] + 5;
                 if (response_len > 255)
                         response_len = first_inquiry_len;       /* sanity */
 
@@ -575,7 +605,8 @@ static int scsi_probe_lun(struct scsi_device *sdev, char *inq_result,
  *     SCSI_SCAN_NO_RESPONSE: could not allocate or setup a scsi_device
  *     SCSI_SCAN_LUN_PRESENT: a new scsi_device was allocated and initialized
  **/
-static int scsi_add_lun(struct scsi_device *sdev, char *inq_result, int *bflags)
+static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
+                int *bflags)
 {
         /*
          * XXX do not save the inquiry, since it can change underneath us,