summaryrefslogtreecommitdiff
path: root/drivers/scsi
diff options
context:
space:
mode:
authorDan Williams <dan.j.williams@intel.com>2011-06-15 11:11:03 -0700
committerDan Williams <dan.j.williams@intel.com>2011-07-03 04:04:51 -0700
commit360b03ed178a4fe3971b0a098d8feeb53333481b (patch)
tree4641e9eb68e1e027aa089e4a21c862c1170ca056 /drivers/scsi
parent0d0cf14c9bd2943ed5afd15df459f564d85eacde (diff)
downloadlinux-3.10-360b03ed178a4fe3971b0a098d8feeb53333481b.tar.gz
linux-3.10-360b03ed178a4fe3971b0a098d8feeb53333481b.tar.bz2
linux-3.10-360b03ed178a4fe3971b0a098d8feeb53333481b.zip
isci: fix ssp response iu buffer size in isci_tmf
In isci_task_request_complete() we save the response/sense data from the command. Make sure isci_tmf has enough space to hold the full response. [ it does not look like we actually use this data, and response_data_len/sense_data_len should be specifying the byte count, in any event do the simple fix first so we don't corrupt memory ] Reported-by: Adam Gruchala <adam.gruchala@intel.com> Tested-by: Edmund Nadolski <edmund.nadolski@intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r--drivers/scsi/isci/task.h3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/scsi/isci/task.h b/drivers/scsi/isci/task.h
index c8dd075d2be..d574a18956d 100644
--- a/drivers/scsi/isci/task.h
+++ b/drivers/scsi/isci/task.h
@@ -100,7 +100,8 @@ struct isci_tmf {
union {
struct ssp_response_iu resp_iu;
struct dev_to_host_fis d2h_fis;
- } resp;
+ u8 rsp_buf[SSP_RESP_IU_MAX_SIZE];
+ } resp;
unsigned char lun[8];
u16 io_tag;
struct isci_remote_device *device;