public inbox for linux-scsi@vger.kernel.org
 help / color / mirror / Atom feed
* Re: inquiry in scsi_scan.c
@ 2003-01-05 13:07 Andries.Brouwer
  2003-01-05 19:36 ` Luben Tuikov
                   ` (2 more replies)
  0 siblings, 3 replies; 14+ messages in thread
From: Andries.Brouwer @ 2003-01-05 13:07 UTC (permalink / raw)
  To: mdharm-kernel; +Cc: Andries.Brouwer, linux-kernel, linux-scsi, linux-usb-devel

Matthew Dharm writes:

> Instead of fixing this in usb-storage, I think I would rather make
> scsi_scan.c just assume a minimum of 36.

No, because (for SCSI-1) the minimum is 5.

> Or, put another way, if the first request indicates less than 36, why
> should we do a second request?  We already have all the data...

We don't do a second request.

> Actually, we ask for 36 and get 36, but the field in the response which is
> supposed to tell us how much there is total is zeroed out, instead of
> having a real value.

Right.

> All we need to do is recognize when that field indicates less than 36
> bytes, and then stop asking for anything else.  Either (a) the device is
> lying, in which case our original INQUIRY is fine, or (b) the device really
> has less than 36 bytes, which means that we already have all the data.

I think you misunderstand the problems. We do not ask for anything else.
There are two problems: a SCSI and a USB problem.

In the SCSI code a length of 5 is legal. Now the code
allocates space for these 5 bytes but subsequently uses
pointers to vendor etc that point past the end of the allocated area.
If ever anything is written via these pointers random memory is corrupted.
And "cat /proc/scsi/scsi" shows randow junk.
A bug that has to be fixed, independently of USB.

The SCSI code has no means of knowing the actual length transferred,
so has no choice but to believe the length byte in the reply.
But the USB code does the transferring itself, and knows precisely
how many bytes were transferred. If 36 bytes were transferred and
the additional length byte is 0, indicating a length of 5, then the
USB code can fix the response and change the additional length byte
to 31, indicating a length of 36. That way the SCSI code knows that
not 5 but 36 bytes are valid, and it gets actual vendor and model strings.

Andries


[the code I showed does the right things; will submit actual diffs
sooner or later]

^ permalink raw reply	[flat|nested] 14+ messages in thread
* Re: Re: inquiry in scsi_scan.c
@ 2003-01-06 19:18 Andries.Brouwer
  2003-01-06 19:22 ` Matthew Dharm
  0 siblings, 1 reply; 14+ messages in thread
From: Andries.Brouwer @ 2003-01-06 19:18 UTC (permalink / raw)
  To: luben, stern; +Cc: Andries.Brouwer, linux-scsi, linux-usb-devel, mdharm-kernel

> In the case reported, the problem was

Ha, Alan - it is possible that the two of you are referring
to different things.

I mentioned two devices, both return 36 bytes when asked for
36 bytes, but the first has 0 in the additional length field
(thus reports length 5), the second has 32 in the additional
length field (thus reports length 37).
This second device, when asked for 37 bytes, still only returns 36.

Andries


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
linux-usb-devel@lists.sourceforge.net
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel

^ permalink raw reply	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2003-01-07  3:42 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-01-05 13:07 inquiry in scsi_scan.c Andries.Brouwer
2003-01-05 19:36 ` Luben Tuikov
2003-01-05 20:54 ` Zwane Mwaikambo
2003-01-06 15:03 ` [linux-usb-devel] " Alan Stern
2003-01-06 16:43   ` Luben Tuikov
2003-01-06 18:54     ` Alan Stern
  -- strict thread matches above, loose matches on Subject: below --
2003-01-06 19:18 Andries.Brouwer
2003-01-06 19:22 ` Matthew Dharm
2003-01-06 20:49   ` [linux-usb-devel] " Luben Tuikov
2003-01-06 21:03     ` James Bottomley
2003-01-06 21:05     ` Matthew Dharm
2003-01-06 21:16       ` [linux-usb-devel] " Luben Tuikov
2003-01-06 22:07         ` Doug Ledford
2003-01-06 22:10     ` Doug Ledford
2003-01-06 22:23   ` Doug Ledford
2003-01-07  0:46     ` Matthew Dharm
2003-01-07  3:42       ` Doug Ledford

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox