diff options
| author | Jens Axboe <axboe@fb.com> | 2017-04-21 16:46:44 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@fb.com> | 2017-04-21 16:46:44 +0200 |
| commit | 95c55ff425faa190fd8ba55090fbdf33d8b2f0ae (patch) | |
| tree | ed110696e538cbe27f2e589f44fb7adf9f9ca35c /drivers/block/mtip32xx | |
| parent | blk-stat: kill blk_stat_rq_ddir() (diff) | |
| download | linux-95c55ff425faa190fd8ba55090fbdf33d8b2f0ae.tar.xz linux-95c55ff425faa190fd8ba55090fbdf33d8b2f0ae.zip | |
mtip32xx: fix dereference of stack garbage
We need to get the command payload from the request before
we attempt to dereference it.
Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'drivers/block/mtip32xx')
| -rw-r--r-- | drivers/block/mtip32xx/mtip32xx.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c index 66a6bd83faae..54c8736038de 100644 --- a/drivers/block/mtip32xx/mtip32xx.c +++ b/drivers/block/mtip32xx/mtip32xx.c @@ -4108,6 +4108,7 @@ static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv) struct mtip_cmd *cmd; if (likely(!reserv)) { + cmd = blk_mq_rq_to_pdu(rq); cmd->status = -ENODEV; blk_mq_complete_request(rq); } else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) { |