V3s_Allwinner
/
uboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

ahci: Fix data abort on multiple scsi resets. 

Commit 2faf5fb82e introduced a regression that causes a data
abort when running scsi init followed by scsi reset.

There are 2 problems with the original commit
1) ALLOC_CACHE_ALIGN_BUFFER() allocates memory on the stack but is
assigned to ataid[port] and used by other functions.
2) The function ata_scsiop_inquiry() tries to free memory which was
never allocated on the heap.

Fix these problems by using tmpid as a temporary cache aligned buffer.
Allocate memory separately for ataid[port] and re-use it if required.

Fixes: 2faf5fb82e (ahci: Fix cache align error messages)

Reported-by: Eli Nidam <elini@marvell.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
This commit is contained in:
Roger Quadros 2014-04-01 17:26:40 +03:00 committed by Tom Rini
parent 1336e2d343
commit 3f62971162
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/block/ahci.c
View File

@ -623,6 +623,7 @@ static int ata_scsiop_inquiry(ccb *pccb)
95 - 4,
};
u8 fis[20];
u16 *idbuf;
ALLOC_CACHE_ALIGN_BUFFER(u16, tmpid, ATA_ID_WORDS);
u8 port;
@ -649,17 +650,25 @@ static int ata_scsiop_inquiry(ccb *pccb)
return -EIO;
}
if (ataid[port])
free(ataid[port]);
ataid[port] = tmpid;
ata_swap_buf_le16(tmpid, ATA_ID_WORDS);
if (!ataid[port]) {
ataid[port] = malloc(ATA_ID_WORDS * 2);
if (!ataid[port]) {
printf("%s: No memory for ataid[port]\n", __func__);
return -ENOMEM;
}
}
idbuf = ataid[port];
memcpy(idbuf, tmpid, ATA_ID_WORDS * 2);
ata_swap_buf_le16(idbuf, ATA_ID_WORDS);
memcpy(&pccb->pdata[8], "ATA ", 8);
ata_id_strcpy((u16 *) &pccb->pdata[16], &tmpid[ATA_ID_PROD], 16);
ata_id_strcpy((u16 *) &pccb->pdata[32], &tmpid[ATA_ID_FW_REV], 4);
ata_id_strcpy((u16 *)&pccb->pdata[16], &idbuf[ATA_ID_PROD], 16);
ata_id_strcpy((u16 *)&pccb->pdata[32], &idbuf[ATA_ID_FW_REV], 4);
#ifdef DEBUG
ata_dump_id(tmpid);
ata_dump_id(idbuf);
#endif
return 0;
}