diff options
| author | Keith Busch <keith.busch@intel.com> | 2018-01-31 17:01:58 -0700 |
|---|---|---|
| committer | Sagi Grimberg <sagi@grimberg.me> | 2018-02-08 18:35:55 +0200 |
| commit | 8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae (patch) | |
| tree | 41bb9867524fea4fff139d1c8a40f9d5825066eb | |
| parent | 3096a739d2ccbfd6a626e388228a16558f76d79d (diff) | |
| download | linux-8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae.tar.gz linux-8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae.tar.bz2 linux-8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae.zip | |
nvme: Fix discard buffer overrun
This patch checks the discard range array bounds before setting it in
case the driver gets a badly formed request.
Signed-off-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
| -rw-r--r-- | drivers/nvme/host/core.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 1f9278364196..2fd8688cfa47 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -518,9 +518,11 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector); u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift; - range[n].cattr = cpu_to_le32(0); - range[n].nlb = cpu_to_le32(nlb); - range[n].slba = cpu_to_le64(slba); + if (n < segments) { + range[n].cattr = cpu_to_le32(0); + range[n].nlb = cpu_to_le32(nlb); + range[n].slba = cpu_to_le64(slba); + } n++; } |