Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Three fixes.  One is the qla24xx MSI regression, one is a theoretical
  problem over blacklist matching, which would bite USB badly if it ever
  triggered and one is a system hang with a particular type of IPR
  device"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  qla2xxx: Fix NULL pointer deref in QLA interrupt
  SCSI: fix new bug in scsi_dev_info_list string matching
  ipr: Clear interrupt on croc/crocodile when running with LSI

3 files changed, 8 insertions, 5 deletions

diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index d6a691e27d33..d6803a9e5ab8 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -10093,6 +10093,7 @@ static int ipr_probe_ioa(struct pci_dev *pdev,
                 ioa_cfg->intr_flag = IPR_USE_MSI;
         else {
                 ioa_cfg->intr_flag = IPR_USE_LSI;
+                ioa_cfg->clear_isr = 1;
                 ioa_cfg->nvectors = 1;
                 dev_info(&pdev->dev, "Cannot enable MSI.\n");
         }
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 5649c200d37c..a92a62dea793 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2548,7 +2548,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
         if (!vha->flags.online)
                 return;
 
-        if (rsp->msix->cpuid != smp_processor_id()) {
+        if (rsp->msix && rsp->msix->cpuid != smp_processor_id()) {
                 /* if kernel does not notify qla of IRQ's CPU change,
                  * then set it here.
                  */
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index ff41c310c900..eaccd651ccda 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -429,7 +429,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
          * here, and we don't know what device it is
          * trying to work with, leave it as-is.
          */
-        vmax = 8;       /* max length of vendor */
+        vmax = sizeof(devinfo->vendor);
         vskip = vendor;
         while (vmax > 0 && *vskip == ' ') {
                 vmax--;
@@ -439,7 +439,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
         while (vmax > 0 && vskip[vmax - 1] == ' ')
                 --vmax;
 
-        mmax = 16;      /* max length of model */
+        mmax = sizeof(devinfo->model);
         mskip = model;
         while (mmax > 0 && *mskip == ' ') {
                 mmax--;
@@ -455,10 +455,12 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                          * Behave like the older version of get_device_flags.
                          */
                         if (memcmp(devinfo->vendor, vskip, vmax) ||
-                                        devinfo->vendor[vmax])
+                                        (vmax < sizeof(devinfo->vendor) &&
+                                                devinfo->vendor[vmax]))
                                 continue;
                         if (memcmp(devinfo->model, mskip, mmax) ||
-                                        devinfo->model[mmax])
+                                        (mmax < sizeof(devinfo->model) &&
+                                                devinfo->model[mmax]))
                                 continue;
                         return devinfo;
                 } else {