diff options
| author | Jeff Garzik <jgarzik@pobox.com> | 2005-11-12 07:27:07 +0100 |
|---|---|---|
| committer | Jeff Garzik <jgarzik@pobox.com> | 2005-11-12 07:27:07 +0100 |
| commit | 828d09de4a6c922517f533093583b9fe8cbf5808 (patch) | |
| tree | 44ceae8c3ead9f534a0c31b03038dc253658ad9c /drivers/scsi/sata_qstor.c | |
| parent | Linux v2.6.15-rc1 (diff) | |
| download | linux-828d09de4a6c922517f533093583b9fe8cbf5808.tar.xz linux-828d09de4a6c922517f533093583b9fe8cbf5808.zip | |
[libata ahci, qstor] fix miscount of scatter/gather entries
Don't directly reference qc->n_elem, as that might cause an off-by-one
error for misaligned (padded) ATAPI transfers.
Diffstat (limited to 'drivers/scsi/sata_qstor.c')
| -rw-r--r-- | drivers/scsi/sata_qstor.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/scsi/sata_qstor.c b/drivers/scsi/sata_qstor.c index b2f6324a2eb2..4a6d3067d23c 100644 --- a/drivers/scsi/sata_qstor.c +++ b/drivers/scsi/sata_qstor.c @@ -268,7 +268,7 @@ static void qs_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val) writel(val, (void __iomem *)(ap->ioaddr.scr_addr + (sc_reg * 8))); } -static void qs_fill_sg(struct ata_queued_cmd *qc) +static unsigned int qs_fill_sg(struct ata_queued_cmd *qc) { struct scatterlist *sg; struct ata_port *ap = qc->ap; @@ -296,6 +296,8 @@ static void qs_fill_sg(struct ata_queued_cmd *qc) (unsigned long long)addr, len); nelem++; } + + return nelem; } static void qs_qc_prep(struct ata_queued_cmd *qc) @@ -304,6 +306,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc) u8 dflags = QS_DF_PORD, *buf = pp->pkt; u8 hflags = QS_HF_DAT | QS_HF_IEN | QS_HF_VLD; u64 addr; + unsigned int nelem; VPRINTK("ENTER\n"); @@ -313,7 +316,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc) return; } - qs_fill_sg(qc); + nelem = qs_fill_sg(qc); if ((qc->tf.flags & ATA_TFLAG_WRITE)) hflags |= QS_HF_DIRO; @@ -324,7 +327,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc) buf[ 0] = QS_HCB_HDR; buf[ 1] = hflags; *(__le32 *)(&buf[ 4]) = cpu_to_le32(qc->nsect * ATA_SECT_SIZE); - *(__le32 *)(&buf[ 8]) = cpu_to_le32(qc->n_elem); + *(__le32 *)(&buf[ 8]) = cpu_to_le32(nelem); addr = ((u64)pp->pkt_dma) + QS_CPB_BYTES; *(__le64 *)(&buf[16]) = cpu_to_le64(addr); |