summaryrefslogtreecommitdiff
path: root/drivers/scsi
diff options
context:
space:
mode:
authorAndrew Vasquez <andrew.vasquez@qlogic.com>2013-02-08 01:57:58 -0500
committerJames Bottomley <JBottomley@Parallels.com>2013-02-22 14:11:46 +0000
commit4ac8d4ca5d8d3bb98072be2961dd2e937e05bb11 (patch)
tree4073e0385d0411e24737e900291176ea6a86ca5d /drivers/scsi
parent827210ba2a368058c72cf93e66d7d8aeb55922eb (diff)
[SCSI] qla2xxx: Correct list-iteration bug in Report-ID Acquisition codes.
Code in qla24xx_report_id_acquisition() incorrectly assumed that upon completion of list iteration (with no match), the 'pos' (vp) variable passed to list_for_each_entry() would be set to NULL. In this context, if the firmware were to return an unrecognized vp_idx, the follow-on assignments to vp-members could result in corruption of the structure. Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com> Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r--drivers/scsi/qla2xxx/qla_mbx.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 2b6782d1f80b..dc0fe52c972e 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3141,6 +3141,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
struct qla_hw_data *ha = vha->hw;
scsi_qla_host_t *vp;
unsigned long flags;
+ int found;
ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6,
"Entered %s.\n", __func__);
@@ -3176,13 +3177,17 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
return;
}
+ found = 0;
spin_lock_irqsave(&ha->vport_slock, flags);
- list_for_each_entry(vp, &ha->vp_list, list)
- if (vp_idx == vp->vp_idx)
+ list_for_each_entry(vp, &ha->vp_list, list) {
+ if (vp_idx == vp->vp_idx) {
+ found = 1;
break;
+ }
+ }
spin_unlock_irqrestore(&ha->vport_slock, flags);
- if (!vp)
+ if (!found)
return;
vp->d_id.b.domain = rptid_entry->port_id[2];