Merge tag 'drm-intel-next-fixes-2020-02-13' of git://anongit.freedesktop.org/drm...

[linux.git] / drivers / scsi / qla2xxx / qla_isr.c

diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index e7bad0bfffda1c09446396bc1eab1d023f4c5c89..e40705d38cea72abec4388e8bc35226b1634eac7 100644 (file)
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1939,6 +1939,18 @@ static void qla24xx_nvme_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
                inbuf = (uint32_t *)&sts->nvme_ersp_data;
                outbuf = (uint32_t *)fd->rspaddr;
                iocb->u.nvme.rsp_pyld_len = le16_to_cpu(sts->nvme_rsp_pyld_len);
+               if (unlikely(iocb->u.nvme.rsp_pyld_len >
+                   sizeof(struct nvme_fc_ersp_iu))) {
+                       if (ql_mask_match(ql_dbg_io)) {
+                               WARN_ONCE(1, "Unexpected response payload length %u.\n",
+                                   iocb->u.nvme.rsp_pyld_len);
+                               ql_log(ql_log_warn, fcport->vha, 0x5100,
+                                   "Unexpected response payload length %u.\n",
+                                   iocb->u.nvme.rsp_pyld_len);
+                       }
+                       iocb->u.nvme.rsp_pyld_len =
+                           sizeof(struct nvme_fc_ersp_iu);
+               }
                iter = iocb->u.nvme.rsp_pyld_len >> 2;
                for (; iter; iter--)
                        *outbuf++ = swab32(*inbuf++);