diff --git a/[refs] b/[refs] index 154a5382566f..f20fb3114dda 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 3afa294c40013be5d8180005002e3f648d04d942 +refs/heads/master: 5d497cecdeae75351567d20b86d8a3a05e7f48ed diff --git a/trunk/drivers/scsi/aacraid/commctrl.c b/trunk/drivers/scsi/aacraid/commctrl.c index fc268a410c27..1fef92d55dee 100644 --- a/trunk/drivers/scsi/aacraid/commctrl.c +++ b/trunk/drivers/scsi/aacraid/commctrl.c @@ -451,7 +451,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) * Allocate and initialize a Fib then setup a BlockWrite command */ if (!(srbfib = fib_alloc(dev))) { - return -1; + return -ENOMEM; } fib_init(srbfib); @@ -490,10 +490,11 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) srbcmd->channel = cpu_to_le32(user_srbcmd->channel); srbcmd->id = cpu_to_le32(user_srbcmd->id); srbcmd->lun = cpu_to_le32(user_srbcmd->lun); - srbcmd->flags = cpu_to_le32(flags); srbcmd->timeout = cpu_to_le32(user_srbcmd->timeout); - srbcmd->retry_limit =cpu_to_le32(0); // Obsolete parameter + srbcmd->flags = cpu_to_le32(flags); + srbcmd->retry_limit = 0; // Obsolete parameter srbcmd->cdb_size = cpu_to_le32(user_srbcmd->cdb_size); + memcpy(srbcmd->cdb, user_srbcmd->cdb, sizeof(srbcmd->cdb)); switch (flags & (SRB_DataIn | SRB_DataOut)) { case SRB_DataOut: @@ -508,7 +509,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) default: data_dir = DMA_NONE; } - if (le32_to_cpu(srbcmd->sg.count) > (sizeof(sg_list)/sizeof(sg_list[0]))) { + if (user_srbcmd->sg.count > (sizeof(sg_list)/sizeof(sg_list[0]))) { dprintk((KERN_DEBUG"aacraid: too many sg entries %d\n", le32_to_cpu(srbcmd->sg.count))); rcode = -EINVAL; @@ -592,7 +593,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) struct sgmap* psg = &srbcmd->sg; byte_count = 0; - actual_fibsize = sizeof (struct aac_srb) + (((le32_to_cpu(srbcmd->sg.count) & 0xff) - 1) * sizeof (struct sgentry)); + actual_fibsize = sizeof (struct aac_srb) + (((user_srbcmd->sg.count & 0xff) - 1) * sizeof (struct sgentry)); if(actual_fibsize != fibsize){ // User made a mistake - should not continue dprintk((KERN_DEBUG"aacraid: Bad Size specified in Raw SRB command\n")); rcode = -EINVAL; @@ -639,7 +640,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) if (status != 0){ dprintk((KERN_DEBUG"aacraid: Could not send raw srb fib to hba\n")); - rcode = -1; + rcode = -ENXIO; goto cleanup; }