From 8fa8d662a339a1d0951c58a4f35d8865d12d00cc Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Thu, 26 May 2016 01:31:00 +0200 Subject: Fix buffer size passed to scsi_do_cmd * linux/src/drivers/scsi/eata_dma_proc.c (eata_proc_info): Increase cmd size to 12. * linux/src/drivers/scsi/sd.c (do_sd_request, sd_init_done): Likewise. * linux/src/drivers/scsi/sr.c (do_sr_request, sr_init_done): Likewise. * linux/src/drivers/scsi/sr_ioctl.c (sr_ioctl): Likewise with sr_cmd. --- linux/src/drivers/scsi/eata_dma_proc.c | 2 +- linux/src/drivers/scsi/sd.c | 4 ++-- linux/src/drivers/scsi/sr.c | 4 ++-- linux/src/drivers/scsi/sr_ioctl.c | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) (limited to 'linux/src') diff --git a/linux/src/drivers/scsi/eata_dma_proc.c b/linux/src/drivers/scsi/eata_dma_proc.c index 3a3a19aa..14a4c968 100644 --- a/linux/src/drivers/scsi/eata_dma_proc.c +++ b/linux/src/drivers/scsi/eata_dma_proc.c @@ -71,7 +71,7 @@ int eata_proc_info(char *buffer, char **start, off_t offset, int length, Scsi_Device *scd, SDev; struct Scsi_Host *HBA_ptr; Scsi_Cmnd scmd; - char cmnd[10]; + char cmnd[12]; static u8 buff[512]; static u8 buff2[512]; hst_cmd_stat *rhcs, *whcs; diff --git a/linux/src/drivers/scsi/sd.c b/linux/src/drivers/scsi/sd.c index d5f1524a..eab64dda 100644 --- a/linux/src/drivers/scsi/sd.c +++ b/linux/src/drivers/scsi/sd.c @@ -577,7 +577,7 @@ static void do_sd_request (void) static void requeue_sd_request (Scsi_Cmnd * SCpnt) { int dev, devm, block, this_count; - unsigned char cmd[10]; + unsigned char cmd[12]; int bounce_size, contiguous; int max_sg; struct buffer_head * bh, *bhp; @@ -1028,7 +1028,7 @@ static void sd_init_done (Scsi_Cmnd * SCpnt) static int sd_init_onedisk(int i) { - unsigned char cmd[10]; + unsigned char cmd[12]; unsigned char *buffer; unsigned long spintime; int the_result, retries; diff --git a/linux/src/drivers/scsi/sr.c b/linux/src/drivers/scsi/sr.c index 8f442460..be64fb11 100644 --- a/linux/src/drivers/scsi/sr.c +++ b/linux/src/drivers/scsi/sr.c @@ -719,7 +719,7 @@ static void do_sr_request (void) void requeue_sr_request (Scsi_Cmnd * SCpnt) { unsigned int dev, block, realcount; - unsigned char cmd[10], *buffer, tries; + unsigned char cmd[12], *buffer, tries; int this_count, start, end_rec; tries = 2; @@ -1056,7 +1056,7 @@ static void sr_init_done (Scsi_Cmnd * SCpnt) } void get_sectorsize(int i){ - unsigned char cmd[10]; + unsigned char cmd[12]; unsigned char *buffer; int the_result, retries; Scsi_Cmnd * SCpnt; diff --git a/linux/src/drivers/scsi/sr_ioctl.c b/linux/src/drivers/scsi/sr_ioctl.c index be62eb8c..6d8b6332 100644 --- a/linux/src/drivers/scsi/sr_ioctl.c +++ b/linux/src/drivers/scsi/sr_ioctl.c @@ -92,7 +92,7 @@ static int do_ioctl(int target, unsigned char * sr_cmd, void * buffer, unsigned int sr_ioctl(struct inode * inode, struct file * file, unsigned int cmd, unsigned long arg) { - u_char sr_cmd[10]; + u_char sr_cmd[12]; kdev_t dev = inode->i_rdev; int result, target, err; -- cgit v1.2.3