redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

[SCSI] qla2xxx: Fix request queue null dereference. 

If an invalid IOCB is returned on the response queue then the index into the
request queue map could be invalid and could return to us a bogus value. This
could cause us to try to deference an invalid pointer and cause an exception.

If we encounter this condition, simply return as no context can be established
for this response.

Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
hifive-unleashed-5.1
Chad Dupuis 2013-10-03 03:21:13 -04:00 committed by James Bottomley
parent 6541932ea2
commit 36008cf118
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/scsi/qla2xxx/qla_dbg.c
View File

@ -20,7 +20,7 @@
* | Device Discovery | 0x2095 | 0x2020-0x2022, |
* | | | 0x2011-0x2012, |
* | | | 0x2016 |
* | Queue Command and IO tracing | 0x3058 | 0x3006-0x300b |
* | Queue Command and IO tracing | 0x3059 | 0x3006-0x300b |
* | | | 0x3027-0x3028 |
* | | | 0x303d-0x3041 |
* | | | 0x302d,0x3033 |

9
drivers/scsi/qla2xxx/qla_isr.c
View File

@ -1957,6 +1957,15 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
que = MSW(sts->handle);
req = ha->req_q_map[que];
/* Check for invalid queue pointer */
if (req == NULL ||
que >= find_first_zero_bit(ha->req_qid_map, ha->max_req_queues)) {
ql_dbg(ql_dbg_io, vha, 0x3059,
"Invalid status handle (0x%x): Bad req pointer. req=%p, "
"que=%u.\n", sts->handle, req, que);
return;
}
/* Validate handle. */
if (handle < req->num_outstanding_cmds)
sp = req->outstanding_cmds[handle];