From 4ac8d4ca5d8d3bb98072be2961dd2e937e05bb11 Mon Sep 17 00:00:00 2001 From: Andrew Vasquez Date: Fri, 8 Feb 2013 01:57:58 -0500 Subject: [PATCH] [SCSI] qla2xxx: Correct list-iteration bug in Report-ID Acquisition codes. Code in qla24xx_report_id_acquisition() incorrectly assumed that upon completion of list iteration (with no match), the 'pos' (vp) variable passed to list_for_each_entry() would be set to NULL. In this context, if the firmware were to return an unrecognized vp_idx, the follow-on assignments to vp-members could result in corruption of the structure. Signed-off-by: Andrew Vasquez Signed-off-by: Saurav Kashyap Signed-off-by: James Bottomley --- drivers/scsi/qla2xxx/qla_mbx.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c index 2b6782d..dc0fe52 100644 --- a/drivers/scsi/qla2xxx/qla_mbx.c +++ b/drivers/scsi/qla2xxx/qla_mbx.c @@ -3141,6 +3141,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, struct qla_hw_data *ha = vha->hw; scsi_qla_host_t *vp; unsigned long flags; + int found; ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6, "Entered %s.\n", __func__); @@ -3176,13 +3177,17 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, return; } + found = 0; spin_lock_irqsave(&ha->vport_slock, flags); - list_for_each_entry(vp, &ha->vp_list, list) - if (vp_idx == vp->vp_idx) + list_for_each_entry(vp, &ha->vp_list, list) { + if (vp_idx == vp->vp_idx) { + found = 1; break; + } + } spin_unlock_irqrestore(&ha->vport_slock, flags); - if (!vp) + if (!found) return; vp->d_id.b.domain = rptid_entry->port_id[2]; -- 2.7.4