Correct an off-by-one in the calculation of the inquiry buffer length

to request from devices during the "long inquiry" portion of our probe.
This same bug was fixed in the 4.x stream a few years ago, but the fix
was never propogated to -current.

This fix is slightly different than in -stable:

 o Use offsetof() instead of a hard coded constant so as the make
   the code more self-explainatory.

 o Round odd long inquiry lengths up so as to avoid tickling ignore
   wide residue bugs in broken parallel SCSI devices running with a
   wide transfer negotiation.

MFC: 3 days

1 files changed, 11 insertions, 1 deletions

diff --git a/sys/cam/cam_xpt.c b/sys/cam/cam_xpt.c
index 40833f5..d0b5baf 100644
--- a/sys/cam/cam_xpt.c
+++ b/sys/cam/cam_xpt.c
@@ -5651,7 +5651,17 @@ probestart(struct cam_periph *periph, union ccb *start_ccb)
 		if (softc->action == PROBE_INQUIRY)
 			inquiry_len = SHORT_INQUIRY_LENGTH;
 		else
-			inquiry_len = inq_buf->additional_length + 4;
+			inquiry_len = inq_buf->additional_length
+				    + offsetof(struct scsi_inquiry_data,
+                                               additional_length) + 1;
+
+		/*
+		 * Some parallel SCSI devices fail to send an
+		 * ignore wide residue message when dealing with
+		 * odd length inquiry requests.  Round up to be
+		 * safe.
+		 */
+		inquiry_len = roundup2(inquiry_len, 2);
 	
 		scsi_inquiry(csio,
 			     /*retries*/4,