summaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorHannes Reinecke <hare@suse.de>2016-03-15 12:03:28 -0700
committerJens Axboe <axboe@fb.com>2016-03-15 12:03:28 -0700
commit4ee86babe09f0682a60b1c56be99819bbe4ba62c (patch)
tree4b94ce88f3586a56448416947a659933b46bb97f /block
parent2b885517110cbe8724fef30363778b6284d0a428 (diff)
downloadlinux-sh-4ee86babe09f0682a60b1c56be99819bbe4ba62c.tar.gz
blk-mq: add bounds check on tag-to-rq conversion
We need to check for a valid index before accessing the array element to avoid accessing invalid memory regions. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jeff Moyer <jmoyer@redhat.com> Modified by Jens to drop the unlikely(), and make the fall through path be having a valid tag. Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'block')
-rw-r--r--block/blk-mq.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 5667f59c277c..261b6feddae6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -544,7 +544,10 @@ EXPORT_SYMBOL(blk_mq_abort_requeue_list);
struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag)
{
- return tags->rqs[tag];
+ if (tag < tags->nr_tags)
+ return tags->rqs[tag];
+
+ return NULL;
}
EXPORT_SYMBOL(blk_mq_tag_to_rq);