Skip to content
  • Quinn Tran's avatar
    qla2xxx: Fix stale pointer access. · cb43285f
    Quinn Tran authored
    [ Upstream Commit 84e32a06 ]
    
    Commit 84e32a06
    
     ("qla2xxx: Use pci_enable_msix_range() instead of
    pci_enable_msix()") introduced a regression when target mode is enabled.
    In qla24xx_enable_msix(), ha->max_rsp_queues was incorrectly set
    to a value higher than the number of response queues allocated causing
    an invalid dereference. Specifically here in qla2x00_init_rings():
        *rsp->in_ptr = 0;
    
    Add additional check to make sure the pointer is valid. following
    call stack will be seen
    
    ---- 8< ----
    RIP: 0010:[<ffffffffa02ccadc>]  [<ffffffffa02ccadc>] qla2x00_init_rings+0xdc/0x320 [qla2xxx]
    RSP: 0018:ffff880429447dd8  EFLAGS: 00010082
    ....
    Call Trace:
    [<ffffffffa02ceb40>] qla2x00_abort_isp+0x170/0x6b0 [qla2xxx]
    [<ffffffffa02c6f77>] qla2x00_do_dpc+0x357/0x7f0 [qla2xxx]
    [<ffffffffa02c6c20>] ? qla2x00_relogin+0x260/0x260 [qla2xxx]
    [<ffffffff8107d2c9>] kthread+0xc9/0xe0
    [<ffffffff8107d200>] ? flush_kthread_worker+0x90/0x90
    [<ffffffff8172cc6f>] ret_from_fork+0x3f/0x70
    [<ffffffff8107d200>] ? flush_kthread_worker+0x90/0x90
    ---- 8< ----
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarQuinn Tran <quinn.tran@qlogic.com>
    Signed-off-by: default avatarHimanshu Madhani <himanshu.madhani@qlogic.com>
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    cb43285f