aboutsummaryrefslogtreecommitdiff
path: root/drivers/tc
diff options
context:
space:
mode:
authorJoerg Dorchain <joerg@dorchain.net>2007-03-06 02:46:54 -0800
committerJames Bottomley <jejb@mulgrave.il.steeleye.com>2007-03-11 10:58:49 -0500
commitbb9ba31ca3b88fd396e38950d1caedf2f83521c6 (patch)
tree18981413f6395e915395e862fc3b3436adea2b88 /drivers/tc
parentba76ef246090601b783c1e6190e22b8b149a105f (diff)
[SCSI] gdth: fix oops in gdth_copy_cmd()
Recent alterations to the gdth_fill_raw_cmd() path no longer set the sg_ranz field for zero transfer commands. However, this field is used lower down in the function to initialise ha->cmd_len to the size of the firmware packet. If this uninitialised field contains a bogus value, ha->cmd_len can become much larger than the actual firmware packet and end up oopsing in gdth_copy_cmd() as it tries to copy this huge packet to the device (usually because it runs into an unallocated page). The fix is to initialise the sg_ranz field to zero at the start of gdth_fill_raw_cmd(). Signed-off-by: Joerg Dorchain <joerg@dorchain.net> Acked-by: "Leubner, Achim" <Achim_Leubner@adaptec.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Diffstat (limited to 'drivers/tc')
0 files changed, 0 insertions, 0 deletions