From: Dan Williams <dan.j.williams@intel.com>
Date: Wed, 15 Jun 2011 18:11:03 +0000 (-0700)
Subject: isci: fix ssp response iu buffer size in isci_tmf
X-Git-Tag: v3.0-rc6~1^2~1^2~27
X-Git-Url: https://git.kernelconcepts.de/?p=karo-tx-linux.git;a=commitdiff_plain;h=360b03ed178a4fe3971b0a098d8feeb53333481b

isci: fix ssp response iu buffer size in isci_tmf

In isci_task_request_complete() we save the response/sense data from the
command.  Make sure isci_tmf has enough space to hold the full response.

[ it does not look like we actually use this data, and
  response_data_len/sense_data_len should be specifying the byte count,
  in any event do the simple fix first so we don't corrupt memory ]

Reported-by: Adam Gruchala <adam.gruchala@intel.com>
Tested-by: Edmund Nadolski <edmund.nadolski@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---

diff --git a/drivers/scsi/isci/task.h b/drivers/scsi/isci/task.h
index c8dd075d2be2..d574a18956d7 100644
--- a/drivers/scsi/isci/task.h
+++ b/drivers/scsi/isci/task.h
@@ -100,7 +100,8 @@ struct isci_tmf {
 	union {
 		struct ssp_response_iu resp_iu;
 		struct dev_to_host_fis d2h_fis;
-	}                            resp;
+		u8 rsp_buf[SSP_RESP_IU_MAX_SIZE];
+	} resp;
 	unsigned char lun[8];
 	u16 io_tag;
 	struct isci_remote_device *device;