Commit b73aa56e authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Martin K. Petersen
Browse files

scsi: libfc: safeguard against invalid exchange index 



The cached exchange index might be invalid, in which case
we should drop down to allocate a new one.
And we should not try to access an invalid exchange when
responding to a BA_ABTS.

Signed-off-by: default avatarHannes Reinecke <hare@suse.com>
Reviewed-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 5d339d16

drivers/scsi/libfc/fc_exch.c

+14 −7
Original line number Diff line number Diff line
@@ -827,15 +827,19 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport, 


	/* peek cache of free slot */

	if (pool->left != FC_XID_UNKNOWN) {

		if (!WARN_ON(fc_exch_ptr_get(pool, pool->left))) {

			index = pool->left;

			pool->left = FC_XID_UNKNOWN;

			goto hit;

		}

	}

	if (pool->right != FC_XID_UNKNOWN) {

		if (!WARN_ON(fc_exch_ptr_get(pool, pool->right))) {

			index = pool->right;

			pool->right = FC_XID_UNKNOWN;

			goto hit;

		}

	}



	index = pool->next_index;

	/* allocate new exch from pool */
@@ -1782,7 +1786,10 @@ static void fc_exch_recv_bls(struct fc_exch_mgr *mp, struct fc_frame *fp) 
				fc_frame_free(fp);

			break;

		case FC_RCTL_BA_ABTS:

			if (ep)

				fc_exch_recv_abts(ep, fp);

			else

				fc_frame_free(fp);

			break;

		default:			/* ignore junk */

			fc_frame_free(fp);