svn commit: r287866 - head/sys/cam/scsi

[Alexander Motin]

Author: mav
Date: Wed Sep 16 17:56:24 2015
New Revision: 287866
URL: https://svnweb.freebsd.org/changeset/base/287866

Log:
  Fix fixed sense writing when passed more data then it can fit.
  
  MFC after:	1 week

Modified:
  head/sys/cam/scsi/scsi_all.c

Modified: head/sys/cam/scsi/scsi_all.c
==============================================================================
--- head/sys/cam/scsi/scsi_all.c	Wed Sep 16 17:44:45 2015	(r287865)
+++ head/sys/cam/scsi/scsi_all.c	Wed Sep 16 17:56:24 2015	(r287866)
@@ -3804,8 +3804,6 @@ scsi_set_sense_data_va(struct scsi_sense
 			 */
 			sense->extra_len = 10;
 			sense_len = (int)va_arg(ap, int);
-			len_to_copy = MIN(sense_len, SSD_EXTRA_MAX -
-					  sense->extra_len);
 			data = (uint8_t *)va_arg(ap, uint8_t *);
 
 			switch (elem_type) {
@@ -3823,10 +3821,14 @@ scsi_set_sense_data_va(struct scsi_sense
 				uint8_t *data_dest;
 				int i;
 
-				if (elem_type == SSD_ELEM_COMMAND)
+				if (elem_type == SSD_ELEM_COMMAND) {
 					data_dest = &sense->cmd_spec_info[0];
-				else {
+					len_to_copy = MIN(sense_len,
+					    sizeof(sense->cmd_spec_info));
+				} else {
 					data_dest = &sense->info[0];
+					len_to_copy = MIN(sense_len,
+					    sizeof(sense->info));
 					/*
 					 * We're setting the info field, so
 					 * set the valid bit.