2 files changed, 10 insertions, 1 deletions

diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 2ef497ebadc0..ee5c1833eb73 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -20,7 +20,7 @@
  * | Device Discovery             |       0x2095       | 0x2020-0x2022, |
  * |                              |                    | 0x2011-0x2012, |
  * |                              |                    | 0x2016         |
- * | Queue Command and IO tracing |       0x3058       | 0x3006-0x300b  |
+ * | Queue Command and IO tracing |       0x3059       | 0x3006-0x300b  |
  * |                              |                    | 0x3027-0x3028  |
  * |                              |                    | 0x303d-0x3041  |
  * |                              |                    | 0x302d,0x3033  |
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index df1b30ba938c..ff9c86b1a0d8 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1957,6 +1957,15 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
         que = MSW(sts->handle);
         req = ha->req_q_map[que];
 
+        /* Check for invalid queue pointer */
+        if (req == NULL ||
+            que >= find_first_zero_bit(ha->req_qid_map, ha->max_req_queues)) {
+                ql_dbg(ql_dbg_io, vha, 0x3059,
+                    "Invalid status handle (0x%x): Bad req pointer. req=%p, "
+                    "que=%u.\n", sts->handle, req, que);
+                return;
+        }
+
         /* Validate handle. */
         if (handle < req->num_outstanding_cmds)
                 sp = req->outstanding_cmds[handle];