Attachment #218194 for bug #249395




	struct cam_periph *periph;
	struct sg_softc *softc;
	struct sg_io_hdr *req;
	void *data_ptr;
	int dir, error;

	periph = (struct cam_periph *)dev->si_drv1;

			break;
		}

		if (req->dxfer_len > MAXPHYS) {
			error = EINVAL;
			break;
		}

		data_ptr = malloc(req->dxfer_len, M_DEVBUF, M_WAITOK);

		ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
		csio = &ccb->csio;


		error = copyin(req->cmdp, &csio->cdb_io.cdb_bytes,
		    req->cmd_len);
		if (error) {
			free(data_ptr, M_DEVBUF);
			xpt_release_ccb(ccb);
			break;
		}

			break;
		}

		if (dir == CAM_DIR_IN || dir == CAM_DIR_BOTH) {
			error = copyin(req->dxferp, data_ptr, req->dxfer_len);
			if (error) {
				free(data_ptr, M_DEVBUF);
				xpt_release_ccb(ccb);
				break;
			}
		}

		cam_fill_csio(csio,
			      /*retries*/1,
			      /*cbfcnp*/NULL,
			      dir|CAM_DEV_QFRZDIS,
			      MSG_SIMPLE_Q_TAG,
			      req->dxferp,
			      req->dxfer_len,
			      req->mx_sb_len,
			      req->cmd_len,

		if (error) {
			req->host_status = DID_ERROR;
			req->driver_status = DRIVER_INVALID;
			free(data_ptr, M_DEVBUF);
			xpt_release_ccb(ccb);
			break;
		}

					req->sb_len_wr);
		}

		if ((dir == CAM_DIR_OUT || dir == CAM_DIR_BOTH) && error == 0)
			error = copyout(data_ptr, req->dxferp, req->dxfer_len);

		free(data_ptr, M_DEVBUF);
		xpt_release_ccb(ccb);
		break;
		

Return to bug 249395

Lines 508-514 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, Link Here

(-)scsi_sg.c (-24 / +1 lines)
508	struct cam_periph *periph;	508	struct cam_periph *periph;
509	struct sg_softc *softc;	509	struct sg_softc *softc;
510	struct sg_io_hdr *req;	510	struct sg_io_hdr *req;
511	void *data_ptr;
512	int dir, error;	511	int dir, error;
513		512
514	periph = (struct cam_periph *)dev->si_drv1;	513	periph = (struct cam_periph *)dev->si_drv1;
Lines 553-565 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, Link Here
553	break;	552	break;
554	}	553	}
555		554
556	if (req->dxfer_len > MAXPHYS) {
557	error = EINVAL;
558	break;
559	}
560
561	data_ptr = malloc(req->dxfer_len, M_DEVBUF, M_WAITOK);
562
563	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);	555	ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
564	csio = &ccb->csio;	556	csio = &ccb->csio;
565		557
Lines 566-572 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, Link Here
566	error = copyin(req->cmdp, &csio->cdb_io.cdb_bytes,	558	error = copyin(req->cmdp, &csio->cdb_io.cdb_bytes,
567	req->cmd_len);	559	req->cmd_len);
568	if (error) {	560	if (error) {
569	free(data_ptr, M_DEVBUF);
570	xpt_release_ccb(ccb);	561	xpt_release_ccb(ccb);
571	break;	562	break;
572	}	563	}
Lines 587-607 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, Link Here
587	break;	578	break;
588	}	579	}
589		580
590	if (dir == CAM_DIR_IN \|\| dir == CAM_DIR_BOTH) {
591	error = copyin(req->dxferp, data_ptr, req->dxfer_len);
592	if (error) {
593	free(data_ptr, M_DEVBUF);
594	xpt_release_ccb(ccb);
595	break;
596	}
597	}
598
599	cam_fill_csio(csio,	581	cam_fill_csio(csio,
600	/retries/1,	582	/retries/1,
601	/cbfcnp/NULL,	583	/cbfcnp/NULL,
602	dir\|CAM_DEV_QFRZDIS,	584	dir\|CAM_DEV_QFRZDIS,
603	MSG_SIMPLE_Q_TAG,	585	MSG_SIMPLE_Q_TAG,
604	data_ptr,	586	req->dxferp,
605	req->dxfer_len,	587	req->dxfer_len,
606	req->mx_sb_len,	588	req->mx_sb_len,
607	req->cmd_len,	589	req->cmd_len,
Lines 611-617 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, Link Here
611	if (error) {	593	if (error) {
612	req->host_status = DID_ERROR;	594	req->host_status = DID_ERROR;
613	req->driver_status = DRIVER_INVALID;	595	req->driver_status = DRIVER_INVALID;
614	free(data_ptr, M_DEVBUF);
615	xpt_release_ccb(ccb);	596	xpt_release_ccb(ccb);
616	break;	597	break;
617	}	598	}
Lines 630-639 sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, Link Here
630	req->sb_len_wr);	611	req->sb_len_wr);
631	}	612	}
632		613
633	if ((dir == CAM_DIR_OUT \|\| dir == CAM_DIR_BOTH) && error == 0)
634	error = copyout(data_ptr, req->dxferp, req->dxfer_len);
635
636	free(data_ptr, M_DEVBUF);
637	xpt_release_ccb(ccb);	614	xpt_release_ccb(ccb);
638	break;	615	break;
639		616