[src/trunk]: src/sys/dev/scsipi Limit buffer size for device capabilities req...

[reinoud <reinoud%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/19d2d9593d13
branches:  trunk
changeset: 1020575:19d2d9593d13
user:      reinoud <reinoud%NetBSD.org@localhost>
date:      Fri Apr 16 12:58:54 2021 +0000

description:
Limit buffer size for device capabilities requests as a work-around for PR
kern/56109.

diffstat:

 sys/dev/scsipi/cd.c |  18 ++++++++----------
 1 files changed, 8 insertions(+), 10 deletions(-)

diffs (61 lines):

diff -r 58eeed328a74 -r 19d2d9593d13 sys/dev/scsipi/cd.c
--- a/sys/dev/scsipi/cd.c       Fri Apr 16 08:09:40 2021 +0000
+++ b/sys/dev/scsipi/cd.c       Fri Apr 16 12:58:54 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: cd.c,v 1.350 2021/02/10 16:30:01 christos Exp $        */
+/*     $NetBSD: cd.c,v 1.351 2021/04/16 12:58:54 reinoud Exp $ */
 
 /*-
  * Copyright (c) 1998, 2001, 2003, 2004, 2005, 2008 The NetBSD Foundation,
@@ -50,7 +50,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.350 2021/02/10 16:30:01 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cd.c,v 1.351 2021/04/16 12:58:54 reinoud Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -2695,15 +2695,13 @@
        struct scsipi_get_conf_feature   *gcf;
        struct scsipi_read_discinfo       di_cmd;
        struct scsipi_read_discinfo_data  di __aligned(2);
-       const uint32_t buffer_size = 1024;
-       uint32_t feat_tbl_len, pos;
+       const uint32_t buffer_size = 0x200; /* XXX RPZ USB3 SCSI size issue */
+       uint32_t pos;
        u_long   last_lba = 0;
        uint8_t  *buffer, *fpos;
        int feature, last_feature, features_len, feature_cur, feature_len;
        int lsb, msb, error, flags;
 
-       feat_tbl_len = buffer_size;
-
        buffer = malloc(buffer_size, M_TEMP, M_WAITOK);
 
        /* initialise structure */
@@ -2748,12 +2746,12 @@
                memset(&gc_cmd, 0, sizeof(gc_cmd));
                gc_cmd.opcode = GET_CONFIGURATION;
                _lto2b(last_feature, gc_cmd.start_at_feature);
-               _lto2b(feat_tbl_len, gc_cmd.data_len);
-               memset(gc, 0, feat_tbl_len);
+               _lto2b(buffer_size, gc_cmd.data_len);
+               memset(gc, 0, buffer_size);
 
                error = scsipi_command(periph,
                        (void *)&gc_cmd, sizeof(gc_cmd),
-                       (void *) gc,     feat_tbl_len,
+                       (void *) gc,     buffer_size,
                        CDRETRIES, 30000, NULL, flags);
                if (error) {
                        /* ieeek... break out of loop... i dunno what to do */
@@ -2761,7 +2759,7 @@
                }
 
                features_len = _4btol(gc->data_len);
-               if (features_len < 4 || features_len > feat_tbl_len)
+               if (features_len < 4 || features_len > buffer_size)
                        break;
 
                pos  = 0;