diff options
| author | yl194034 <none@none> | 2008-03-03 00:38:56 -0800 |
|---|---|---|
| committer | yl194034 <none@none> | 2008-03-03 00:38:56 -0800 |
| commit | a024987b44f2d4e0956e61bc4abfec4f0886d480 (patch) | |
| tree | 93181af8c9c26b9f3a9d1286927304e9ca4f2701 /usr/src | |
| parent | 088109eeeb9075338f48e57790fe76dee8dd7755 (diff) | |
| download | illumos-joyent-a024987b44f2d4e0956e61bc4abfec4f0886d480.tar.gz | |
6661641 Using USCSI to execute SCSI command read position panics the system
Diffstat (limited to 'usr/src')
| -rw-r--r-- | usr/src/uts/common/io/scsi/targets/st.c | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/usr/src/uts/common/io/scsi/targets/st.c b/usr/src/uts/common/io/scsi/targets/st.c index ffd78c89f9..c72ef8843f 100644 --- a/usr/src/uts/common/io/scsi/targets/st.c +++ b/usr/src/uts/common/io/scsi/targets/st.c @@ -14039,8 +14039,23 @@ st_get_read_pos(struct scsi_tape *un, buf_t *bp) return (EIO); } - pos_info = bp->b_un.b_addr; d_sz = bp->b_bcount - bp->b_resid; + if (d_sz == 0) { + bp_mapout(bp); + return (EIO); + } + + /* + * Copy the buf to a double-word aligned memory that can hold the + * tape_position_t data structure. + */ + if ((pos_info = kmem_alloc(d_sz, KM_NOSLEEP)) == NULL) { + scsi_log(ST_DEVINFO, st_label, SCSI_DEBUG, + "kmem_alloc() failed"); + bp_mapout(bp); + return (EIO); + } + bcopy(bp->b_un.b_addr, pos_info, d_sz); #ifdef STDEBUG if ((st_debug & 0x7) > 2) { @@ -14055,6 +14070,7 @@ st_get_read_pos(struct scsi_tape *un, buf_t *bp) COPY_POS(&un->un_running, &un->un_pos); + kmem_free(pos_info, d_sz); bp_mapout(bp); return (result); |