kern/66479: mpt has a bug when creating chain elements.

[HITOSHI Osada]

>Number:         66479
>Category:       kern
>Synopsis:       mpt has a bug when creating chain elements.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon May 10 10:00:39 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     HITOSHI Osada
>Release:        5.2
>Organization:
>Environment:
>Description:
There is a bug in mpt_run_xfer().

I found this bug in NetBSD and the same bug exists in mpt_freebsd.c.
>How-To-Repeat:
Access SCSI disks via mpt.
>Fix:
--- mpt_freebsd.c~      2004-05-11 01:42:29.000000000 +0900
+++ mpt_freebsd.c       2004-05-11 01:50:06.000000000 +0900
@@ -268,11 +268,13 @@
                                ntodo = MPT_NSGL(mpt) - 1;
                                ce->NextChainOffset = (MPT_RQSL(mpt) -
                                    sizeof (SGE_SIMPLE32)) >> 2;
+                               ce->Length = MPT_NSGL(mpt)
+                                               * sizeof(SGE_SIMPLE32);
                        } else {
                                ntodo = nleft;
                                ce->NextChainOffset = 0;
+                               ce->Length = ntodo * sizeof (SGE_SIMPLE32);
                        }
-                       ce->Length = ntodo * sizeof (SGE_SIMPLE32);
                        ce->Address = req->req_pbuf +
                            ((char *)se - (char *)mpt_req);
                        ce->Flags = MPI_SGE_FLAGS_CHAIN_ELEMENT;

>Release-Note:
>Audit-Trail:
>Unformatted: