[SCSI] qla2xxx: Correct list-iteration bug in Report-ID Acquisition codes.

Code in qla24xx_report_id_acquisition() incorrectly assumed that
upon completion of list iteration (with no match), the 'pos'
(vp) variable passed to list_for_each_entry() would be set to
NULL.  In this context, if the firmware were to return an
unrecognized vp_idx, the follow-on assignments to vp-members
could result in corruption of the structure.

Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

1 files changed, 8 insertions, 3 deletions

diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 2b6782d1f80b..dc0fe52c972e 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3141,6 +3141,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
         struct qla_hw_data *ha = vha->hw;
         scsi_qla_host_t *vp;
         unsigned long   flags;
+        int found;
 
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6,
             "Entered %s.\n", __func__);
@@ -3176,13 +3177,17 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                         return;
                 }
 
+                found = 0;
                 spin_lock_irqsave(&ha->vport_slock, flags);
-                list_for_each_entry(vp, &ha->vp_list, list)
-                        if (vp_idx == vp->vp_idx)
+                list_for_each_entry(vp, &ha->vp_list, list) {
+                        if (vp_idx == vp->vp_idx) {
+                                found = 1;
                                 break;
+                        }
+                }
                 spin_unlock_irqrestore(&ha->vport_slock, flags);
 
-                if (!vp)
+                if (!found)
                         return;
 
                 vp->d_id.b.domain = rptid_entry->port_id[2];