lkml.org 
[lkml]   [2017]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: mtip32xx: add a status field to struct mtip_cmd
From
Date
On 04/21/2017 08:06 AM, Colin Ian King wrote:
> Hi,
>
> CoverityScan found an issue with the following part of the patch:
>
> - if (likely(!reserv))
> - blk_mq_complete_request(rq, -ENODEV);
> - else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
> + if (likely(!reserv)) {
> + cmd->status = -ENODEV;
> + blk_mq_complete_request(rq, 0);
> + } else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
>
>
From: Jens Axboe <axboe@fb.com>
Subject: [PATCH] mtip32xx: fix dereference of stack garbage

We need to get the command payload from the request before
we attempt to dereference it.

Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
Signed-off-by: Jens Axboe <axboe@fb.com>

diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 66a6bd83faae..54c8736038de 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4108,6 +4108,7 @@ static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
struct mtip_cmd *cmd;

if (likely(!reserv)) {
+ cmd = blk_mq_rq_to_pdu(rq);
cmd->status = -ENODEV;
blk_mq_complete_request(rq);
} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
--
Jens Axboe

\
 
 \ /
  Last update: 2017-04-21 16:16    [W:0.043 / U:2.560 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site