odd dxfer_len == crash

[Giuliano Pochini]

ioctl(SG_IO) with odd dxfer_len hangs the machine. I have a dual G4 MDD and
and ide dvd-rw and I can't locate che bug. I'm posting here because the
program below doesn't crash on a PC. Any clue? TIA.

Linux Jay 2.6.27 #2 SMP Wed Oct 15 00:33:06 CEST 2008 ppc 7455, altivec supported PowerMac3,6 GNU/Linux



#include <unistd.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <scsi/sg.h>

#define TOCLEN 0xbf	// 0xbf 191


int main() {
  int fd, ret, i;
  sg_io_hdr_t sg_io;
  unsigned char databuffer[256];
  unsigned char sensebuffer[SG_MAX_SENSE];

  fd = open("/dev/hdf", O_RDONLY);
  if (fd < 0) {
    printf("error: %s\n", strerror(errno));
    return(errno);
  }

  memset(&sg_io, 0, sizeof(sg_io));
  sg_io.interface_id = 'S';
  sg_io.dxfer_direction = SG_DXFER_FROM_DEV;
  sg_io.cmd_len = 10;
  sg_io.mx_sb_len = SG_MAX_SENSE;
  sg_io.dxfer_len = TOCLEN;
  sg_io.dxferp = databuffer;
  sg_io.cmdp = (unsigned char [10]){0x43, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, TOCLEN, 0x00};
  sg_io.sbp = sensebuffer;
  sg_io.timeout = 10*1000;

  ret = ioctl(fd, SG_IO, &sg_io);

  close(fd);
  return(0);
}


--
Giuliano.