On Tue, 29 Feb 2000, David S. Miller wrote:
> Date: Tue, 29 Feb 2000 23:38:24 +0100 (MET)
> From: Gerard Roudier <groudier@club-internet.fr>
>
> The sym53c8xx driver now trusts the data transfer direction of SCSI
> commands supplied by upper layers. If this information is wrong, this will
> not work. (I will try to let the driver detect properly bad data phase in
> some further driver version).
>
> My-be, the application you are using sends an IOCTL_SEND_COMMAND to some
> drivers and if a non zero input buffer length is provided direction is
> assumed WRITE by scsi_ioctl.c, which is wrong for INQUIRY (just guessing).
>
> You are partially correct Gerard.
>
> The problem is in fact that sc_data_direction is left set at
> SCSI_DATA_NONE for a scsi command that actually does transfer
> data.
>
> The culprit is sr.c:sr_packet().
>
> So the bug is that the generic cdrom layer needs to pass a data
> direction into the CDROM packet driver function, and I've told
> Jens Axboe to work on fixing this. I've CC:'d him here as a
> reminder.
Ok.
By the way, scsi_ioctl_send_command() declares the variables 'inlen',
'outlen', 'needed' and 'buf_needed' as '_signed_ int' but all its code is
dealing with them as if they were 'unsigned'. This looks like a more
serious bug to me given that inputs come from user-space.
How much currect am I there ? :-)
> Any CDROM mount or other access will trigger this.
I noticed the problem when testing my latest driver changes (couldn't
mount my CD/ROM), but haven't have time to investigate. :-)
Gérard.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Tue Mar 07 2000 - 21:00:10 EST