mvumi_receive_ob_list_entry() copies a completion out of the outbound list and then writes 0xff over the tag, so that the entry is rejected if the firmware's copy pointer brings the driver back to it. The comment right above the checks says why that can happen: "Copy pointer may point to entry in outbound list before entry has valid data". Nothing ever compares a tag against 0xff. The only test for a usable entry is tag >= mhba->tag_pool.size and tag_pool.size is mhba->max_io, which the firmware supplies in the u16 max_io_support. As soon as the firmware asks for more than 255 commands, 0xff is a tag in range and tag_cmd[255] can hold a live command, so a stale consumed entry is no longer turned away by its tag. What happens next depends on the controller. Where request_id_enabled is set, mvumi_check_ob_frame() still compares the request_id left in the entry and rejects the frame. Where it is not set, and the MV9580 case in mvumi_init_fw() never sets it, that comparison is skipped, so the entry passes, is copied, and completes whichever command owns tag 255 with the bytes of an older completion. The tag field is a u16 and tag_pool.size is an unsigned short, so 0xffff is >= every value the bound can take and is never a valid tag. Stamp that instead. The store is the same width it was. Fixes: f0c568a478f0 ("[SCSI] mvumi: Add Marvell UMI driver") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee --- drivers/scsi/mvumi.c | 2 +- drivers/scsi/mvumi.h | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c index 133e53bc2cb37..994c04902fa12 100644 --- a/drivers/scsi/mvumi.c +++ b/drivers/scsi/mvumi.c @@ -562,7 +562,7 @@ static void mvumi_receive_ob_list_entry(struct mvumi_hba *mhba) } memcpy(ob_data->data, p_outb_frame, mhba->ob_max_size); - p_outb_frame->tag = 0xff; + p_outb_frame->tag = MVUMI_TAG_CONSUMED; list_add_tail(&ob_data->list, &mhba->free_ob_list); } diff --git a/drivers/scsi/mvumi.h b/drivers/scsi/mvumi.h index 3fc76addbf304..d998c65c26472 100644 --- a/drivers/scsi/mvumi.h +++ b/drivers/scsi/mvumi.h @@ -133,6 +133,12 @@ enum { */ #define MVUMI_MAX_TARGET_ID 255 +/* + * Stamped into a consumed outbound list entry. A valid tag is below + * tag_pool.size, which is a u16, so the largest u16 is never one. + */ +#define MVUMI_TAG_CONSUMED 0xffff + #define DEVICE_OFFLINE 0 #define DEVICE_ONLINE 1 -- 2.43.0