Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (158 commits)
  [SCSI] Fix printing of failed 32-byte commands
  [SCSI] Fix printing of variable length commands
  [SCSI] libsrp: fix bug in ADDITIONAL CDB LENGTH interpretation
  [SCSI] scsi_dh_alua: Add IBM Power Virtual SCSI ALUA device to dev list
  [SCSI] scsi_dh_alua: add netapp to dev list
  [SCSI] qla2xxx: Update version number to 8.03.02-k1.
  [SCSI] qla2xxx: EEH: Restore PCI saved state during pci slot reset.
  [SCSI] qla2xxx: Add firmware ETS burst support.
  [SCSI] qla2xxx: Correct loop-resync issues during SNS scans.
  [SCSI] qla2xxx: Correct use-after-free issue in terminate_rport_io callback.
  [SCSI] qla2xxx: Correct EH bus-reset handling.
  [SCSI] qla2xxx: Proper clean-up of BSG requests when request times out.
  [SCSI] qla2xxx: Initialize payload receive length in failure path of vendor commands
  [SCSI] fix duplicate removal on error path in scsi_sysfs_add_sdev
  [SCSI] fix refcounting bug in scsi_get_host_dev
  [SCSI] fix memory leak in scsi_report_lun_scan
  [SCSI] lpfc: correct PPC build failure
  [SCSI] raid_class: add raid1e
  [SCSI] mpt2sas: Do not call sas_is_tlr_enabled for RAID volumes.
  [SCSI] zfcp: Introduce header file for qdio structs and inline functions
  ...

1 files changed, 12 insertions, 28 deletions

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index a60da5555577..513661f45e5f 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1026,55 +1026,39 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer,
  * responsible for calling kfree() on this pointer when it is no longer
  * needed.  If we cannot retrieve the VPD page this routine returns %NULL.
  */
-unsigned char *scsi_get_vpd_page(struct scsi_device *sdev, u8 page)
+int scsi_get_vpd_page(struct scsi_device *sdev, u8 page, unsigned char *buf,
+		      int buf_len)
 {
 	int i, result;
-	unsigned int len;
-	const unsigned int init_vpd_len = 255;
-	unsigned char *buf = kmalloc(init_vpd_len, GFP_KERNEL);
-
-	if (!buf)
-		return NULL;
 
 	/* Ask for all the pages supported by this device */
-	result = scsi_vpd_inquiry(sdev, buf, 0, init_vpd_len);
+	result = scsi_vpd_inquiry(sdev, buf, 0, buf_len);
 	if (result)
 		goto fail;
 
 	/* If the user actually wanted this page, we can skip the rest */
 	if (page == 0)
-		return buf;
+		return -EINVAL;
 
-	for (i = 0; i < buf[3]; i++)
+	for (i = 0; i < min((int)buf[3], buf_len - 4); i++)
 		if (buf[i + 4] == page)
 			goto found;
+
+	if (i < buf[3] && i > buf_len)
+		/* ran off the end of the buffer, give us benefit of doubt */
+		goto found;
 	/* The device claims it doesn't support the requested page */
 	goto fail;
 
  found:
-	result = scsi_vpd_inquiry(sdev, buf, page, 255);
+	result = scsi_vpd_inquiry(sdev, buf, page, buf_len);
 	if (result)
 		goto fail;
 
-	/*
-	 * Some pages are longer than 255 bytes.  The actual length of
-	 * the page is returned in the header.
-	 */
-	len = ((buf[2] << 8) | buf[3]) + 4;
-	if (len <= init_vpd_len)
-		return buf;
-
-	kfree(buf);
-	buf = kmalloc(len, GFP_KERNEL);
-	result = scsi_vpd_inquiry(sdev, buf, page, len);
-	if (result)
-		goto fail;
-
-	return buf;
+	return 0;
 
  fail:
-	kfree(buf);
-	return NULL;
+	return -EINVAL;
 }
 EXPORT_SYMBOL_GPL(scsi_get_vpd_page);