diff options
| author | Hannes Reinecke <hare@suse.de> | 2016-03-15 12:03:28 -0700 |
|---|---|---|
| committer | Jens Axboe <axboe@fb.com> | 2016-03-15 12:03:28 -0700 |
| commit | 4ee86babe09f0682a60b1c56be99819bbe4ba62c (patch) | |
| tree | 4b94ce88f3586a56448416947a659933b46bb97f /block | |
| parent | 2b885517110cbe8724fef30363778b6284d0a428 (diff) | |
| download | linux-4ee86babe09f0682a60b1c56be99819bbe4ba62c.tar.gz linux-4ee86babe09f0682a60b1c56be99819bbe4ba62c.tar.bz2 linux-4ee86babe09f0682a60b1c56be99819bbe4ba62c.zip | |
blk-mq: add bounds check on tag-to-rq conversion
We need to check for a valid index before accessing the array
element to avoid accessing invalid memory regions.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Modified by Jens to drop the unlikely(), and make the fall through
path be having a valid tag.
Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'block')
| -rw-r--r-- | block/blk-mq.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c index 5667f59c277c..261b6feddae6 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -544,7 +544,10 @@ EXPORT_SYMBOL(blk_mq_abort_requeue_list); struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag) { - return tags->rqs[tag]; + if (tag < tags->nr_tags) + return tags->rqs[tag]; + + return NULL; } EXPORT_SYMBOL(blk_mq_tag_to_rq); |