gdth: fix oops in gdth_copy_cmd()
commitb09bfe3601682228d9b4612a0266359df9710791
authorJoerg Dorchain <joerg@dorchain.net>
Tue, 6 Mar 2007 10:46:54 +0000 (6 02:46 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 23 Mar 2007 19:49:21 +0000 (23 12:49 -0700)
treebcb5cf337f8a0fa1c0311e8793db03b4b7f94400
parent1995b605df589e93a11395ca239891187b7f1bdf
gdth: fix oops in gdth_copy_cmd()

Recent alterations to the gdth_fill_raw_cmd() path no longer set the
sg_ranz field for zero transfer commands. However, this field is used
lower down in the function to initialise ha->cmd_len to the size of
the firmware packet.  If this uninitialised field contains a bogus
value, ha->cmd_len can become much larger than the actual firmware
packet and end up oopsing in gdth_copy_cmd() as it tries to copy this
huge packet to the device (usually because it runs into an unallocated
page).

The fix is to initialise the sg_ranz field to zero at the start of
gdth_fill_raw_cmd().

Signed-off-by: Joerg Dorchain <joerg@dorchain.net>
Acked-by: "Achim Leubner" <Achim_Leubner@adaptec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/scsi/gdth.c