Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0fe70c15 authored by Javed Hasan's avatar Javed Hasan Committed by Greg Kroah-Hartman
Browse files

scsi: libfc: Fix array index out of bound exception 

[ Upstream commit b27c4577557045f1ab3cdfeabfc7f3cd24aca1fe ]

Fix array index out of bound exception in fc_rport_prli_resp().

Link: https://lore.kernel.org/r/20210615165939.24327-1-jhasan@marvell.com


Signed-off-by: default avatarJaved Hasan <jhasan@marvell.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d7b647d0

drivers/scsi/libfc/fc_rport.c

+8 −5
Original line number Diff line number Diff line
@@ -1160,6 +1160,7 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp, 
		resp_code = (pp->spp.spp_flags & FC_SPP_RESP_MASK);

		FC_RPORT_DBG(rdata, "PRLI spp_flags = 0x%x spp_type 0x%x\n",

			     pp->spp.spp_flags, pp->spp.spp_type);



		rdata->spp_type = pp->spp.spp_type;

		if (resp_code != FC_SPP_RESP_ACK) {

			if (resp_code == FC_SPP_RESP_CONF)
@@ -1182,12 +1183,14 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp, 
		/*

		 * Call prli provider if we should act as a target

		 */

		if (rdata->spp_type < FC_FC4_PROV_SIZE) {

			prov = fc_passive_prov[rdata->spp_type];

			if (prov) {

				memset(&temp_spp, 0, sizeof(temp_spp));

				prov->prli(rdata, pp->prli.prli_spp_len,

					   &pp->spp, &temp_spp);

			}

		}

		/*

		 * Check if the image pair could be established

		 */