From fecae40abb1ae9218bdbaa8b8e30bfb5ae43f522 Mon Sep 17 00:00:00 2001 From: Nicholas Bellinger Date: Thu, 1 Nov 2012 18:43:03 -0700 Subject: target: Fix incorrect starting offset after MODE_SENSE refactoring This patch fixes a new off-by-one bug in the hardcoded starting offset of spc_emulate_modesense() code that causes BLOCK DESCRIPTOR to be incorrectly written within the MEDIUM TYPE buffer area of the mode parameter header. According to spc4r30, Section 7.5.4, BLOCK DESCRIPTOR for MODE_SENSE_10 starts at byte 3, and BLOCK_DESCRIPTOR for MODE_SENSE (6) starts at byte 2. (roland: add MODE DATA LENGTH + MEDIUM TYPE offset comment) Cc: Roland Dreier Cc: Christoph Hellwig Cc: Douglas Gilbert Signed-off-by: Nicholas Bellinger --- drivers/target/target_core_spc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c index 33022a3f31fc..f9c2bd02043c 100644 --- a/drivers/target/target_core_spc.c +++ b/drivers/target/target_core_spc.c @@ -870,8 +870,11 @@ static int spc_emulate_modesense(struct se_cmd *cmd) } else { buf = map_buf; } - - length = ten ? 2 : 1; + /* + * Skip over MODE DATA LENGTH + MEDIUM TYPE fields to byte 3 for + * MODE_SENSE_10 and byte 2 for MODE_SENSE (6). + */ + length = ten ? 3 : 2; /* DEVICE-SPECIFIC PARAMETER */ if ((cmd->se_lun->lun_access & TRANSPORT_LUNFLAGS_READ_ONLY) || -- cgit v1.2.3