Commit 67ddda35 authored by Andrew Vasquez's avatar Andrew Vasquez Committed by James Bottomley

[SCSI] qla2xxx: Correct out of bounds read of ISP2200 mailbox registers.

ISP2200 adapters only have 24 mailbox registers so read only that many.
Reported-by: default avatarOlatunji Ruwase <oor@cs.cmu.edu>
Signed-off-by: default avatarAndrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: default avatarChad Dupuis <chad.dupuis@qlogic.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent 7cb0eb1c
...@@ -44,6 +44,7 @@ ...@@ -44,6 +44,7 @@
* ISP2100 HBAs. * ISP2100 HBAs.
*/ */
#define MAILBOX_REGISTER_COUNT_2100 8 #define MAILBOX_REGISTER_COUNT_2100 8
#define MAILBOX_REGISTER_COUNT_2200 24
#define MAILBOX_REGISTER_COUNT 32 #define MAILBOX_REGISTER_COUNT 32
#define QLA2200A_RISC_ROM_VER 4 #define QLA2200A_RISC_ROM_VER 4
......
...@@ -2054,7 +2054,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) ...@@ -2054,7 +2054,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
ha->nvram_data_off = ~0; ha->nvram_data_off = ~0;
ha->isp_ops = &qla2100_isp_ops; ha->isp_ops = &qla2100_isp_ops;
} else if (IS_QLA2200(ha)) { } else if (IS_QLA2200(ha)) {
ha->mbx_count = MAILBOX_REGISTER_COUNT; ha->mbx_count = MAILBOX_REGISTER_COUNT_2200;
req_length = REQUEST_ENTRY_CNT_2200; req_length = REQUEST_ENTRY_CNT_2200;
rsp_length = RESPONSE_ENTRY_CNT_2100; rsp_length = RESPONSE_ENTRY_CNT_2100;
ha->max_loop_id = SNS_LAST_LOOP_ID_2100; ha->max_loop_id = SNS_LAST_LOOP_ID_2100;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment