]> git.baikalelectronics.ru Git - kernel.git/commit
libfc: sanity check cpu number extracted from xid
authorChris Leech <cleech@redhat.com>
Thu, 30 Jun 2016 15:32:36 +0000 (08:32 -0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Thu, 14 Jul 2016 01:49:57 +0000 (21:49 -0400)
commitfbd853e7ceba65bd66acf48c1890048a808cc9a6
tree6f41d942268a64f6c64a6a25eb8eb17f4e6f2ec6
parent9250e37d81f1e9595d9ac7d9861f9c03965fe32c
libfc: sanity check cpu number extracted from xid

In the receive path libfc extracts a cpu number from the ox_id in the
fiber channel header and uses that to do a per_cpu_ptr conversion.  If,
for some reason, a frame is received with an invalid ox_id, per_cpu_ptr
will return an invalid pointer and the libfc receive path will panic the
system trying to use it.

I'm currently looking at such a case, and I don't yet know why a cpu
number > nr_cpu_ids is appearing in an exchange id.  But adding a sanity
check in libfc prevents a system panic, and seems like good idea when
dealing with frames coming in from the network.

Signed-off-by: Chris Leech <cleech@redhat.com>
Acked-by: Johannes Thumshirn <jth@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/libfc/fc_exch.c