Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-12 14:12:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SCSI] qla2xxx: Correct list-iteration bug in Report-ID Acquisition codes.

Browse Source 
Code in qla24xx_report_id_acquisition() incorrectly assumed that
upon completion of list iteration (with no match), the 'pos'
(vp) variable passed to list_for_each_entry() would be set to
NULL.  In this context, if the firmware were to return an
unrecognized vp_idx, the follow-on assignments to vp-members
could result in corruption of the structure.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This commit is contained in:
Andrew Vasquez 2013-02-08 01:57:58 -05:00 committed by James Bottomley
parent 827210ba2a
commit 4ac8d4ca5d
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/scsi/qla2xxx/qla_mbx.c
View File

@ -3141,6 +3141,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
struct qla_hw_data *ha = vha->hw;
scsi_qla_host_t *vp;
unsigned long flags;
int found;
ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6,
"Entered %s.\n", __func__);
@ -3176,13 +3177,17 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
return;
}
found = 0;
spin_lock_irqsave(&ha->vport_slock, flags);
list_for_each_entry(vp, &ha->vp_list, list)
if (vp_idx == vp->vp_idx)
list_for_each_entry(vp, &ha->vp_list, list) {
if (vp_idx == vp->vp_idx) {
found = 1;
break;
}
}
spin_unlock_irqrestore(&ha->vport_slock, flags);
if (!vp)
if (!found)
return;
vp->d_id.b.domain = rptid_entry->port_id[2];