[SCSI] fusion: add message sanity check

This adds a sanity check in the interrupt routine
insures incoming message frames are a valid
message frames.

The code for setting 0xdeadbeaf in the freed message
frames, apparently was already submitted by Christoph
in previous patch submission.

Signed-off-by: Eric Moore <Eric.Moore@lsil.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

1 files changed, 14 insertions, 1 deletions

diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 2e1c9ff4b028..05789e505464 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -560,11 +560,24 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
         MPT_SCSI_HOST   *hd;
         SCSIIORequest_t *pScsiReq;
         SCSIIOReply_t   *pScsiReply;
-        u16              req_idx;
+        u16              req_idx, req_idx_MR;
 
         hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
 
         req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
+        req_idx_MR = (mr != NULL) ?
+            le16_to_cpu(mr->u.frame.hwhdr.msgctxu.fld.req_idx) : req_idx;
+        if ((req_idx != req_idx_MR) ||
+            (mf->u.frame.linkage.arg1 == 0xdeadbeaf)) {
+                printk(MYIOC_s_ERR_FMT "Received a mf that was already freed\n",
+                    ioc->name);
+                printk (MYIOC_s_ERR_FMT
+                    "req_idx=%x req_idx_MR=%x mf=%p mr=%p sc=%p\n",
+                    ioc->name, req_idx, req_idx_MR, mf, mr,
+                    hd->ScsiLookup[req_idx_MR]);
+                return 0;
+        }
+
         sc = hd->ScsiLookup[req_idx];
         if (sc == NULL) {
                 MPIHeader_t *hdr = (MPIHeader_t *)mf;