Skip to content

Commit b27c457

Browse files
javed-hmartinkpetersen
authored andcommitted
scsi: libfc: Fix array index out of bound exception
Fix array index out of bound exception in fc_rport_prli_resp(). Link: https://lore.kernel.org/r/20210615165939.24327-1-jhasan@marvell.com Signed-off-by: Javed Hasan <jhasan@marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent 2506f5d commit b27c457

1 file changed

Lines changed: 8 additions & 5 deletions

File tree

drivers/scsi/libfc/fc_rport.c

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1162,6 +1162,7 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
11621162
resp_code = (pp->spp.spp_flags & FC_SPP_RESP_MASK);
11631163
FC_RPORT_DBG(rdata, "PRLI spp_flags = 0x%x spp_type 0x%x\n",
11641164
pp->spp.spp_flags, pp->spp.spp_type);
1165+
11651166
rdata->spp_type = pp->spp.spp_type;
11661167
if (resp_code != FC_SPP_RESP_ACK) {
11671168
if (resp_code == FC_SPP_RESP_CONF)
@@ -1184,11 +1185,13 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
11841185
/*
11851186
* Call prli provider if we should act as a target
11861187
*/
1187-
prov = fc_passive_prov[rdata->spp_type];
1188-
if (prov) {
1189-
memset(&temp_spp, 0, sizeof(temp_spp));
1190-
prov->prli(rdata, pp->prli.prli_spp_len,
1191-
&pp->spp, &temp_spp);
1188+
if (rdata->spp_type < FC_FC4_PROV_SIZE) {
1189+
prov = fc_passive_prov[rdata->spp_type];
1190+
if (prov) {
1191+
memset(&temp_spp, 0, sizeof(temp_spp));
1192+
prov->prli(rdata, pp->prli.prli_spp_len,
1193+
&pp->spp, &temp_spp);
1194+
}
11921195
}
11931196
/*
11941197
* Check if the image pair could be established

0 commit comments

Comments
 (0)