Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 30 Sep 2020 18:09:51 +0000 (UTC)
From:      John Baldwin <jhb@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r366297 - in stable: 11/sys/cam/scsi 12/sys/cam/scsi
Message-ID:  <202009301809.08UI9p9r088312@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: jhb
Date: Wed Sep 30 18:09:50 2020
New Revision: 366297
URL: https://svnweb.freebsd.org/changeset/base/366297

Log:
  MFC 366175: Revert most of r360179.
  
  I had failed to notice that sgsendccb() was using cam_periph_mapmem()
  and thus was not passing down user pointers directly to drivers.  In
  practice this broke requests submitted from userland.
  
  PR:		249395

Modified:
  stable/11/sys/cam/scsi/scsi_sg.c
Directory Properties:
  stable/11/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/12/sys/cam/scsi/scsi_sg.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/11/sys/cam/scsi/scsi_sg.c
==============================================================================
--- stable/11/sys/cam/scsi/scsi_sg.c	Wed Sep 30 17:49:06 2020	(r366296)
+++ stable/11/sys/cam/scsi/scsi_sg.c	Wed Sep 30 18:09:50 2020	(r366297)
@@ -506,7 +506,6 @@ sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, int
 	struct cam_periph *periph;
 	struct sg_softc *softc;
 	struct sg_io_hdr *req;
-	void *data_ptr;
 	int dir, error;
 
 	periph = (struct cam_periph *)dev->si_drv1;
@@ -551,20 +550,12 @@ sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, int
 			break;
 		}
 
-		if (req->dxfer_len > MAXPHYS) {
-			error = EINVAL;
-			break;
-		}
-
-		data_ptr = malloc(req->dxfer_len, M_DEVBUF, M_WAITOK);
-
 		ccb = cam_periph_getccb(periph, CAM_PRIORITY_NORMAL);
 		csio = &ccb->csio;
 
 		error = copyin(req->cmdp, &csio->cdb_io.cdb_bytes,
 		    req->cmd_len);
 		if (error) {
-			free(data_ptr, M_DEVBUF);
 			xpt_release_ccb(ccb);
 			break;
 		}
@@ -585,21 +576,12 @@ sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, int
 			break;
 		}
 
-		if (dir == CAM_DIR_IN || dir == CAM_DIR_BOTH) {
-			error = copyin(req->dxferp, data_ptr, req->dxfer_len);
-			if (error) {
-				free(data_ptr, M_DEVBUF);
-				xpt_release_ccb(ccb);
-				break;
-			}
-		}
-
 		cam_fill_csio(csio,
 			      /*retries*/1,
 			      sgdone,
 			      dir|CAM_DEV_QFRZDIS,
 			      MSG_SIMPLE_Q_TAG,
-			      data_ptr,
+			      req->dxferp,
 			      req->dxfer_len,
 			      req->mx_sb_len,
 			      req->cmd_len,
@@ -609,7 +591,6 @@ sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, int
 		if (error) {
 			req->host_status = DID_ERROR;
 			req->driver_status = DRIVER_INVALID;
-			free(data_ptr, M_DEVBUF);
 			xpt_release_ccb(ccb);
 			break;
 		}
@@ -628,10 +609,6 @@ sgioctl(struct cdev *dev, u_long cmd, caddr_t arg, int
 					req->sb_len_wr);
 		}
 
-		if ((dir == CAM_DIR_OUT || dir == CAM_DIR_BOTH) && error == 0)
-			error = copyout(data_ptr, req->dxferp, req->dxfer_len);
-
-		free(data_ptr, M_DEVBUF);
 		xpt_release_ccb(ccb);
 		break;

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202009301809.08UI9p9r088312>