From: "Moore, Eric" This adds a sanity check in the interrupt routine insures incoming message frames are a valid message frames. The code for setting 0xdeadbeaf in the freed message frames, apparently was already submitted by Christoph in previous patch submission. Signed-off-by: Eric Moore Signed-off-by: Andrew Morton --- drivers/message/fusion/mptscsih.c | 15 ++++++++++++++- 1 files changed, 14 insertions(+), 1 deletion(-) diff -puN drivers/message/fusion/mptscsih.c~fusion-sanity-check drivers/message/fusion/mptscsih.c --- devel/drivers/message/fusion/mptscsih.c~fusion-sanity-check 2006-01-23 15:39:30.000000000 -0800 +++ devel-akpm/drivers/message/fusion/mptscsih.c 2006-01-23 15:39:30.000000000 -0800 @@ -564,11 +564,24 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_F MPT_SCSI_HOST *hd; SCSIIORequest_t *pScsiReq; SCSIIOReply_t *pScsiReply; - u16 req_idx; + u16 req_idx, req_idx_MR; hd = (MPT_SCSI_HOST *) ioc->sh->hostdata; req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx); + req_idx_MR = (mr != NULL) ? + le16_to_cpu(mr->u.frame.hwhdr.msgctxu.fld.req_idx) : req_idx; + if ((req_idx != req_idx_MR) || + (mf->u.frame.linkage.arg1 == 0xdeadbeaf)) { + printk(MYIOC_s_ERR_FMT "Received a mf that was already freed\n", + ioc->name); + printk (MYIOC_s_ERR_FMT + "req_idx=%x req_idx_MR=%x mf=%p mr=%p sc=%p\n", + ioc->name, req_idx, req_idx_MR, mf, mr, + hd->ScsiLookup[req_idx_MR]); + return 0; + } + sc = hd->ScsiLookup[req_idx]; if (sc == NULL) { MPIHeader_t *hdr = (MPIHeader_t *)mf; _