Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4cb433e8 authored by Nikola Pajkovsky's avatar Nikola Pajkovsky Committed by Martin K. Petersen
Browse files

scsi: aacraid: error: testing array offset 'bus' after use 



Fix possible indexing array of bound for &aac->hba_map[bus][cid], where
bus and cid boundary check happens later.

Fixes: 0d643ff3 ("scsi: aacraid: use aac_tmf_callback for reset fib")
Signed-off-by: default avatarNikola Pajkovsky <npajkovsky@suse.cz>
Reviewed-by: default avatarDave Carroll <david.carroll@microsemi.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 5c756065

drivers/scsi/aacraid/linit.c

+12 −8
Original line number Diff line number Diff line
@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd) 


	bus = aac_logical_to_phys(scmd_channel(cmd));

	cid = scmd_id(cmd);

	info = &aac->hba_map[bus][cid];

	if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||

	    info->devtype != AAC_DEVTYPE_NATIVE_RAW)



	if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)

		return FAILED;



	if (info->reset_state > 0)

	info = &aac->hba_map[bus][cid];



	if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&

	    info->reset_state > 0)

		return FAILED;



	pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd) 


	bus = aac_logical_to_phys(scmd_channel(cmd));

	cid = scmd_id(cmd);

	info = &aac->hba_map[bus][cid];

	if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||

	    info->devtype != AAC_DEVTYPE_NATIVE_RAW)



	if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)

		return FAILED;



	if (info->reset_state > 0)

	info = &aac->hba_map[bus][cid];



	if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&

	    info->reset_state > 0)

		return FAILED;



	pr_err("%s: Host adapter reset request. SCSI hang ?\n",