Skip to content

Commit 4cb433e

Browse files
Nikola Pajkovskymartinkpetersen
authored andcommitted
scsi: aacraid: error: testing array offset 'bus' after use
Fix possible indexing array of bound for &aac->hba_map[bus][cid], where bus and cid boundary check happens later. Fixes: 0d643ff ("scsi: aacraid: use aac_tmf_callback for reset fib") Signed-off-by: Nikola Pajkovsky <npajkovsky@suse.cz> Reviewed-by: Dave Carroll <david.carroll@microsemi.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent 5c75606 commit 4cb433e

File tree

1 file changed

+12
-8
lines changed

1 file changed

+12
-8
lines changed

drivers/scsi/aacraid/linit.c

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
906906

907907
bus = aac_logical_to_phys(scmd_channel(cmd));
908908
cid = scmd_id(cmd);
909-
info = &aac->hba_map[bus][cid];
910-
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
911-
info->devtype != AAC_DEVTYPE_NATIVE_RAW)
909+
910+
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
912911
return FAILED;
913912

914-
if (info->reset_state > 0)
913+
info = &aac->hba_map[bus][cid];
914+
915+
if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
916+
info->reset_state > 0)
915917
return FAILED;
916918

917919
pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
962964

963965
bus = aac_logical_to_phys(scmd_channel(cmd));
964966
cid = scmd_id(cmd);
965-
info = &aac->hba_map[bus][cid];
966-
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
967-
info->devtype != AAC_DEVTYPE_NATIVE_RAW)
967+
968+
if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
968969
return FAILED;
969970

970-
if (info->reset_state > 0)
971+
info = &aac->hba_map[bus][cid];
972+
973+
if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
974+
info->reset_state > 0)
971975
return FAILED;
972976

973977
pr_err("%s: Host adapter reset request. SCSI hang ?\n",

0 commit comments

Comments
 (0)