Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ac8d4ca authored Feb 08, 2013 by Andrew Vasquez Committed by James Bottomley Feb 22, 2013

[SCSI] qla2xxx: Correct list-iteration bug in Report-ID Acquisition codes.



Code in qla24xx_report_id_acquisition() incorrectly assumed that
upon completion of list iteration (with no match), the 'pos'
(vp) variable passed to list_for_each_entry() would be set to
NULL.  In this context, if the firmware were to return an
unrecognized vp_idx, the follow-on assignments to vp-members
could result in corruption of the structure.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

parent 827210ba

drivers/scsi/qla2xxx/qla_mbx.c

+8 −3

Original line number	Original line	Diff line number	Diff line
	@@ -3141,6 +3141,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
	struct qla_hw_data *ha = vha->hw;		struct qla_hw_data *ha = vha->hw;
	scsi_qla_host_t *vp;		scsi_qla_host_t *vp;
	unsigned long flags;		unsigned long flags;
			int found;

	ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6,		ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6,
	"Entered %s.\n", __func__);		"Entered %s.\n", __func__);
	@@ -3176,13 +3177,17 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
	return;		return;
	}		}

			found = 0;
	spin_lock_irqsave(&ha->vport_slock, flags);		spin_lock_irqsave(&ha->vport_slock, flags);
	list_for_each_entry(vp, &ha->vp_list, list)		list_for_each_entry(vp, &ha->vp_list, list) {
	if (vp_idx == vp->vp_idx)		if (vp_idx == vp->vp_idx) {
			found = 1;
	break;		break;
			}
			}
	spin_unlock_irqrestore(&ha->vport_slock, flags);		spin_unlock_irqrestore(&ha->vport_slock, flags);

	if (!vp)		if (!found)
	return;		return;

	vp->d_id.b.domain = rptid_entry->port_id[2];		vp->d_id.b.domain = rptid_entry->port_id[2];