From 360b03ed178a4fe3971b0a098d8feeb53333481b Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Wed, 15 Jun 2011 11:11:03 -0700 Subject: [PATCH] isci: fix ssp response iu buffer size in isci_tmf In isci_task_request_complete() we save the response/sense data from the command. Make sure isci_tmf has enough space to hold the full response. [ it does not look like we actually use this data, and response_data_len/sense_data_len should be specifying the byte count, in any event do the simple fix first so we don't corrupt memory ] Reported-by: Adam Gruchala Tested-by: Edmund Nadolski Signed-off-by: Dan Williams --- drivers/scsi/isci/task.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/isci/task.h b/drivers/scsi/isci/task.h index c8dd075d2be..d574a18956d 100644 --- a/drivers/scsi/isci/task.h +++ b/drivers/scsi/isci/task.h @@ -100,7 +100,8 @@ struct isci_tmf { union { struct ssp_response_iu resp_iu; struct dev_to_host_fis d2h_fis; - } resp; + u8 rsp_buf[SSP_RESP_IU_MAX_SIZE]; + } resp; unsigned char lun[8]; u16 io_tag; struct isci_remote_device *device; -- 2.11.4.GIT