[PATCH v5 6/6] scsi: mvumi: widen the flush cache loop counter

[Yehyeong Lee]

mvumi_flush_cache() walks the targets with an unsigned char counter while
the bound it compares against, mhba->max_target_id, comes from the u16
max_devices_support field of the firmware handshake page.  A controller
reporting 256 or more devices makes the counter wrap back to zero before
it ever reaches the bound, so the loop never ends.  mvumi_flush_cache()
runs from the shutdown, suspend and remove paths, so the firmware can
wedge any of them.

Give the counter the type of the bound.  It is assigned to
frame->device_id, a u16, so nothing truncates it again, and target_map
holds round_up(max_target_id, 8) / 8 bytes, which covers every index the
wider counter produces.  That last part needs the earlier patch in this
series: without the reset check it adds, max_target_id can grow past the
bitmap it was allocated for, and the wider counter would then walk further
past it than the narrow one could.

Fixes: f0c568a478f0 ("[SCSI] mvumi: Add Marvell UMI driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
---
 drivers/scsi/mvumi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
index 07cfac9276e7b..090ae79ec8c3a 100644
--- a/drivers/scsi/mvumi.c
+++ b/drivers/scsi/mvumi.c
@@ -769,8 +769,9 @@ static unsigned char mvumi_flush_cache(struct mvumi_hba *mhba)
 {
 	struct mvumi_cmd *cmd;
 	struct mvumi_msg_frame *frame;
-	unsigned char device_id, retry = 0;
+	unsigned char retry = 0;
 	unsigned char bitcount = sizeof(unsigned char) * 8;
+	unsigned short device_id;
 
 	for (device_id = 0; device_id < mhba->max_target_id; device_id++) {
 		if (!(mhba->target_map[device_id / bitcount] &
-- 
2.43.0