Joerg Dorchain bb9ba31ca3 [SCSI] gdth: fix oops in gdth_copy_cmd()
Recent alterations to the gdth_fill_raw_cmd() path no longer set the
sg_ranz field for zero transfer commands. However, this field is used
lower down in the function to initialise ha->cmd_len to the size of
the firmware packet.  If this uninitialised field contains a bogus
value, ha->cmd_len can become much larger than the actual firmware
packet and end up oopsing in gdth_copy_cmd() as it tries to copy this
huge packet to the device (usually because it runs into an unallocated
page).

The fix is to initialise the sg_ranz field to zero at the start of
gdth_fill_raw_cmd().

Signed-off-by: Joerg Dorchain <joerg@dorchain.net>
Acked-by: "Leubner, Achim" <Achim_Leubner@adaptec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2007-03-11 10:58:49 -05:00
..
2006-09-12 17:12:31 -05:00
2006-09-12 17:12:31 -05:00
2007-02-07 18:32:18 -05:00
2006-08-06 15:59:26 -05:00
2006-11-15 16:41:27 -06:00
2006-09-12 17:12:31 -05:00
2007-02-17 02:40:24 +01:00
2006-11-22 14:57:56 +00:00
2007-02-07 15:50:06 -08:00
2007-01-27 09:26:36 -06:00
2006-09-23 15:33:43 -05:00
2007-02-17 19:36:33 +01:00
2007-01-13 13:49:58 -06:00
2006-12-05 10:25:35 -06:00
2006-09-12 17:12:31 -05:00
2006-11-30 05:24:39 +01:00
2006-11-22 14:57:56 +00:00
2006-11-22 14:57:56 +00:00
2007-01-27 09:28:58 -06:00
2007-02-09 09:14:07 -08:00
2006-11-22 14:57:56 +00:00
2007-01-03 16:57:38 -06:00
2007-01-13 13:49:58 -06:00
2006-03-23 07:38:09 -08:00
2006-11-15 16:43:50 -06:00