aacraid: IOCTL pass-through command fix

Mahesh Rajashekhara · James Bottomley · commit 2f5d1f7998b6 · 2015-04-09T16:44:49.000-07:00
The Linux aacriad driver fails to detect the case of SG list count=0 on IOCTL
pass-through command and cause intermittent fault.  The result is the Linux
aacriad driver send down IOCTL pass-through command with one not initialized
SG list to firmware when receiving SG list count =0 on pass-through command.

Signed-off-by: Mahesh Rajashekhara &lt;Mahesh.Rajashekhara@pmcs.com&gt;
Reviewed-by: Hannes Reinecke &lt;hare@suse.de&gt;
Reviewed-by: Murthy Bhat &lt;Murthy.Bhat@pmcs.com&gt;
Signed-off-by: James Bottomley &lt;JBottomley@Odin.com&gt;
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
@@ -689,7 +689,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 			kfree (usg);
 		}
 		srbcmd->count = cpu_to_le32(byte_count);
-		psg->count = cpu_to_le32(sg_indx+1);
+		if (user_srbcmd->sg.count)
+			psg->count = cpu_to_le32(sg_indx+1);
+		else
+			psg->count = 0;
 		status = aac_fib_send(ScsiPortCommand64, srbfib, actual_fibsize, FsaNormal, 1, 1,NULL,NULL);
 	} else {
 		struct user_sgmap* upsg = &user_srbcmd->sg;
@@ -775,7 +778,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 			}
 		}
 		srbcmd->count = cpu_to_le32(byte_count);
-		psg->count = cpu_to_le32(sg_indx+1);
+		if (user_srbcmd->sg.count)
+			psg->count = cpu_to_le32(sg_indx+1);
+		else
+			psg->count = 0;
 		status = aac_fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL);
 	}
 	if (status == -ERESTARTSYS) {

Original file line number	Diff line number	Diff line change
`@@ -689,7 +689,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)`
`689`	`689`	`kfree (usg);`
`690`	`690`	`}`
`691`	`691`	`srbcmd->count = cpu_to_le32(byte_count);`
`692`		`- psg->count = cpu_to_le32(sg_indx+1);`
	`692`	`+ if (user_srbcmd->sg.count)`
	`693`	`+ psg->count = cpu_to_le32(sg_indx+1);`
	`694`	`+ else`
	`695`	`+ psg->count = 0;`
`693`	`696`	`status = aac_fib_send(ScsiPortCommand64, srbfib, actual_fibsize, FsaNormal, 1, 1,NULL,NULL);`
`694`	`697`	`} else {`
`695`	`698`	`struct user_sgmap* upsg = &user_srbcmd->sg;`
`@@ -775,7 +778,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)`
`775`	`778`	`}`
`776`	`779`	`}`
`777`	`780`	`srbcmd->count = cpu_to_le32(byte_count);`
`778`		`- psg->count = cpu_to_le32(sg_indx+1);`
	`781`	`+ if (user_srbcmd->sg.count)`
	`782`	`+ psg->count = cpu_to_le32(sg_indx+1);`
	`783`	`+ else`
	`784`	`+ psg->count = 0;`
`779`	`785`	`status = aac_fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL);`
`780`	`786`	`}`
`781`	`787`	`if (status == -ERESTARTSYS) {`