提交 4cb433e8 编写于 作者: N Nikola Pajkovsky 提交者: Martin K. Petersen

scsi: aacraid: error: testing array offset 'bus' after use

Fix possible indexing array of bound for &aac->hba_map[bus][cid], where
bus and cid boundary check happens later.

Fixes: 0d643ff3 ("scsi: aacraid: use aac_tmf_callback for reset fib")
Signed-off-by: NNikola Pajkovsky <npajkovsky@suse.cz>
Reviewed-by: NDave Carroll <david.carroll@microsemi.com>
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
上级 5c756065
......@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
bus = aac_logical_to_phys(scmd_channel(cmd));
cid = scmd_id(cmd);
info = &aac->hba_map[bus][cid];
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
info->devtype != AAC_DEVTYPE_NATIVE_RAW)
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
return FAILED;
if (info->reset_state > 0)
info = &aac->hba_map[bus][cid];
if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
info->reset_state > 0)
return FAILED;
pr_err("%s: Host adapter reset request. SCSI hang ?\n",
......@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
bus = aac_logical_to_phys(scmd_channel(cmd));
cid = scmd_id(cmd);
info = &aac->hba_map[bus][cid];
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
info->devtype != AAC_DEVTYPE_NATIVE_RAW)
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
return FAILED;
if (info->reset_state > 0)
info = &aac->hba_map[bus][cid];
if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
info->reset_state > 0)
return FAILED;
pr_err("%s: Host adapter reset request. SCSI hang ?\n",
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册