aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorMoore, Eric <Eric.Moore@lsil.com>2006-01-17 19:06:29 -0500
committerJames Bottomley <jejb@mulgrave.(none)>2006-01-31 15:40:05 -0500
commit2254c86db124a37057116ad20a8de7b8483b6f44 (patch)
tree324c4e17c925d3a229b6f522644c37c67c08e3e6 /drivers
parenta69ac3248513ff0fbbdd8f316136036b3b8067a9 (diff)
[SCSI] fusion: add message sanity check
This adds a sanity check in the interrupt routine insures incoming message frames are a valid message frames. The code for setting 0xdeadbeaf in the freed message frames, apparently was already submitted by Christoph in previous patch submission. Signed-off-by: Eric Moore <Eric.Moore@lsil.com> Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/message/fusion/mptscsih.c15
1 files changed, 14 insertions, 1 deletions
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 2e1c9ff4b028..05789e505464 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -560,11 +560,24 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
560 MPT_SCSI_HOST *hd; 560 MPT_SCSI_HOST *hd;
561 SCSIIORequest_t *pScsiReq; 561 SCSIIORequest_t *pScsiReq;
562 SCSIIOReply_t *pScsiReply; 562 SCSIIOReply_t *pScsiReply;
563 u16 req_idx; 563 u16 req_idx, req_idx_MR;
564 564
565 hd = (MPT_SCSI_HOST *) ioc->sh->hostdata; 565 hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
566 566
567 req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx); 567 req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
568 req_idx_MR = (mr != NULL) ?
569 le16_to_cpu(mr->u.frame.hwhdr.msgctxu.fld.req_idx) : req_idx;
570 if ((req_idx != req_idx_MR) ||
571 (mf->u.frame.linkage.arg1 == 0xdeadbeaf)) {
572 printk(MYIOC_s_ERR_FMT "Received a mf that was already freed\n",
573 ioc->name);
574 printk (MYIOC_s_ERR_FMT
575 "req_idx=%x req_idx_MR=%x mf=%p mr=%p sc=%p\n",
576 ioc->name, req_idx, req_idx_MR, mf, mr,
577 hd->ScsiLookup[req_idx_MR]);
578 return 0;
579 }
580
568 sc = hd->ScsiLookup[req_idx]; 581 sc = hd->ScsiLookup[req_idx];
569 if (sc == NULL) { 582 if (sc == NULL) {
570 MPIHeader_t *hdr = (MPIHeader_t *)mf; 583 MPIHeader_t *hdr = (MPIHeader_t *)mf;