diff options
| author | Keith Busch <keith.busch@intel.com> | 2018-02-01 01:01:58 +0100 |
|---|---|---|
| committer | Sagi Grimberg <sagi@grimberg.me> | 2018-02-08 17:35:55 +0100 |
| commit | 8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae (patch) | |
| tree | 41bb9867524fea4fff139d1c8a40f9d5825066eb /drivers/nvme/host | |
| parent | nvme: delete NVME_CTRL_LIVE --> NVME_CTRL_CONNECTING transition (diff) | |
| download | linux-8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae.tar.xz linux-8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae.zip | |
nvme: Fix discard buffer overrun
This patch checks the discard range array bounds before setting it in
case the driver gets a badly formed request.
Signed-off-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Diffstat (limited to 'drivers/nvme/host')
| -rw-r--r-- | drivers/nvme/host/core.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 1f9278364196..2fd8688cfa47 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -518,9 +518,11 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector); u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift; - range[n].cattr = cpu_to_le32(0); - range[n].nlb = cpu_to_le32(nlb); - range[n].slba = cpu_to_le64(slba); + if (n < segments) { + range[n].cattr = cpu_to_le32(0); + range[n].nlb = cpu_to_le32(nlb); + range[n].slba = cpu_to_le64(slba); + } n++; } |