Commit 2254c86d authored by Moore, Eric's avatar Moore, Eric Committed by James Bottomley

[SCSI] fusion: add message sanity check

This adds a sanity check in the interrupt routine
insures incoming message frames are a valid
message frames.

The code for setting 0xdeadbeaf in the freed message
frames, apparently was already submitted by Christoph
in previous patch submission.
Signed-off-by: default avatarEric Moore <Eric.Moore@lsil.com>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@SteelEye.com>
parent a69ac324
...@@ -560,11 +560,24 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr) ...@@ -560,11 +560,24 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
MPT_SCSI_HOST *hd; MPT_SCSI_HOST *hd;
SCSIIORequest_t *pScsiReq; SCSIIORequest_t *pScsiReq;
SCSIIOReply_t *pScsiReply; SCSIIOReply_t *pScsiReply;
u16 req_idx; u16 req_idx, req_idx_MR;
hd = (MPT_SCSI_HOST *) ioc->sh->hostdata; hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx); req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
req_idx_MR = (mr != NULL) ?
le16_to_cpu(mr->u.frame.hwhdr.msgctxu.fld.req_idx) : req_idx;
if ((req_idx != req_idx_MR) ||
(mf->u.frame.linkage.arg1 == 0xdeadbeaf)) {
printk(MYIOC_s_ERR_FMT "Received a mf that was already freed\n",
ioc->name);
printk (MYIOC_s_ERR_FMT
"req_idx=%x req_idx_MR=%x mf=%p mr=%p sc=%p\n",
ioc->name, req_idx, req_idx_MR, mf, mr,
hd->ScsiLookup[req_idx_MR]);
return 0;
}
sc = hd->ScsiLookup[req_idx]; sc = hd->ScsiLookup[req_idx];
if (sc == NULL) { if (sc == NULL) {
MPIHeader_t *hdr = (MPIHeader_t *)mf; MPIHeader_t *hdr = (MPIHeader_t *)mf;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment