[SCSI] aacraid: fix security weakness

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / scsi / advansys.c

diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 07507a7e9c50f8d708c819d937249bbdd3e925c3..492702ba64630617fb1f6925dc6e772348872d1d 100644 (file)
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -120,7 +120,7 @@ typedef unsigned char uchar;
 #define CC_VERY_LONG_SG_LIST 0
 #define ASC_SRB2SCSIQ(srb_ptr)  (srb_ptr)
 
-#define PortAddr                 unsigned short        /* port address size  */
+#define PortAddr                 unsigned int  /* port address size  */
 #define inp(port)                inb(port)
 #define outp(port, byte)         outb((byte), (port))
 
@@ -8233,7 +8233,7 @@ static void adv_isr_callback(ADV_DVC_VAR *adv_dvc_varp, ADV_SCSI_REQ_Q *scsiqp)
                        if (scsiqp->scsi_status == SAM_STAT_CHECK_CONDITION) {
                                ASC_DBG(2, "SAM_STAT_CHECK_CONDITION\n");
                                ASC_DBG_PRT_SENSE(2, scp->sense_buffer,
-                                                 sizeof(scp->sense_buffer));
+                                                 SCSI_SENSE_BUFFERSIZE);
                                /*
                                 * Note: The 'status_byte()' macro used by
                                 * target drivers defined in scsi.h shifts the
@@ -9136,7 +9136,7 @@ static void asc_isr_callback(ASC_DVC_VAR *asc_dvc_varp, ASC_QDONE_INFO *qdonep)
        BUG_ON(asc_dvc_varp != &boardp->dvc_var.asc_dvc_var);
 
        dma_unmap_single(boardp->dev, scp->SCp.dma_handle,
-                       sizeof(scp->sense_buffer), DMA_FROM_DEVICE);
+                        SCSI_SENSE_BUFFERSIZE, DMA_FROM_DEVICE);
        /*
         * 'qdonep' contains the command's ending status.
         */
@@ -9166,7 +9166,7 @@ static void asc_isr_callback(ASC_DVC_VAR *asc_dvc_varp, ASC_QDONE_INFO *qdonep)
                        if (qdonep->d3.scsi_stat == SAM_STAT_CHECK_CONDITION) {
                                ASC_DBG(2, "SAM_STAT_CHECK_CONDITION\n");
                                ASC_DBG_PRT_SENSE(2, scp->sense_buffer,
-                                                 sizeof(scp->sense_buffer));
+                                                 SCSI_SENSE_BUFFERSIZE);
                                /*
                                 * Note: The 'status_byte()' macro used by
                                 * target drivers defined in scsi.h shifts the
@@ -9881,9 +9881,9 @@ static __le32 advansys_get_sense_buffer_dma(struct scsi_cmnd *scp)
 {
        struct asc_board *board = shost_priv(scp->device->host);
        scp->SCp.dma_handle = dma_map_single(board->dev, scp->sense_buffer,
-                               sizeof(scp->sense_buffer), DMA_FROM_DEVICE);
+                                            SCSI_SENSE_BUFFERSIZE, DMA_FROM_DEVICE);
        dma_cache_sync(board->dev, scp->sense_buffer,
-                               sizeof(scp->sense_buffer), DMA_FROM_DEVICE);
+                      SCSI_SENSE_BUFFERSIZE, DMA_FROM_DEVICE);
        return cpu_to_le32(scp->SCp.dma_handle);
 }
 
@@ -9914,7 +9914,7 @@ static int asc_build_req(struct asc_board *boardp, struct scsi_cmnd *scp,
        asc_scsi_q->q2.target_ix =
            ASC_TIDLUN_TO_IX(scp->device->id, scp->device->lun);
        asc_scsi_q->q1.sense_addr = advansys_get_sense_buffer_dma(scp);
-       asc_scsi_q->q1.sense_len = sizeof(scp->sense_buffer);
+       asc_scsi_q->q1.sense_len = SCSI_SENSE_BUFFERSIZE;
 
        /*
         * If there are any outstanding requests for the current target,
@@ -10173,7 +10173,7 @@ adv_build_req(struct asc_board *boardp, struct scsi_cmnd *scp,
        scsiqp->target_lun = scp->device->lun;
 
        scsiqp->sense_addr = cpu_to_le32(virt_to_bus(&scp->sense_buffer[0]));
-       scsiqp->sense_len = sizeof(scp->sense_buffer);
+       scsiqp->sense_len = SCSI_SENSE_BUFFERSIZE;
 
        /* Build ADV_SCSI_REQ_Q */
 
@@ -13333,8 +13333,8 @@ static int __devinit advansys_wide_init_chip(struct Scsi_Host *shost)
 
        }
 
-       ASC_DBG(1, "sg_cnt %d * %u = %u bytes\n", sg_cnt, sizeof(adv_sgblk_t),
-                (unsigned)(sizeof(adv_sgblk_t) * sg_cnt));
+       ASC_DBG(1, "sg_cnt %d * %lu = %lu bytes\n", sg_cnt, sizeof(adv_sgblk_t),
+                sizeof(adv_sgblk_t) * sg_cnt);
 
        if (!board->adv_sgblkp)
                goto kmalloc_failed;
@@ -13428,9 +13428,9 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
                boardp->ioremap_addr = ioremap(pci_resource_start(pdev, 1),
                                               boardp->asc_n_io_port);
                if (!boardp->ioremap_addr) {
-                       shost_printk(KERN_ERR, shost, "ioremap(%x, %d) "
+                       shost_printk(KERN_ERR, shost, "ioremap(%lx, %d) "
                                        "returned NULL\n",
-                                       pci_resource_start(pdev, 1),
+                                       (long)pci_resource_start(pdev, 1),
                                        boardp->asc_n_io_port);
                        ret = -ENODEV;
                        goto err_shost;