redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

[SCSI] libfc, fcoe: ignore rx frame with wrong xid info 

Drop the rx frame having xid with wrong cpu info
or received with xid  not matching to our xid.

Not dropping such frame is causing panic as
that causes accessing data struct beyond their
bounds.

Signed-off-by: Vasu Dev <vasu.dev@intel.com>
Tested-by: Ross Brattain <ross.b.brattain@intel.com>
Signed-off-by: Robert Love <robert.w.love@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
hifive-unleashed-5.1
Vasu Dev 2011-07-27 15:10:39 -07:00 committed by James Bottomley
parent 6f06e3a7b2
commit 324f667833
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/scsi/fcoe/fcoe.c
View File

@ -1373,6 +1373,10 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *netdev,
} else
cpu = smp_processor_id();
}
if (cpu >= nr_cpu_ids)
goto err;
fps = &per_cpu(fcoe_percpu, cpu);
spin_lock_bh(&fps->fcoe_rx_list.lock);
if (unlikely(!fps->thread)) {

4
drivers/scsi/libfc/fc_exch.c
View File

@ -802,10 +802,8 @@ static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid)
pool = per_cpu_ptr(mp->pool, xid & fc_cpu_mask);
spin_lock_bh(&pool->lock);
ep = fc_exch_ptr_get(pool, (xid - mp->min_xid) >> fc_cpu_order);
if (ep) {
if (ep && ep->xid == xid)
fc_exch_hold(ep);
WARN_ON(ep->xid != xid);
}
spin_unlock_bh(&pool->lock);
}
return ep;