Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95c55ff4 authored by Jens Axboe's avatar Jens Axboe
Browse files

mtip32xx: fix dereference of stack garbage 



We need to get the command payload from the request before
we attempt to dereference it.

Fixes: 4dda4735 ("mtip32xx: add a status field to struct mtip_cmd")
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
parent 99c749a4

drivers/block/mtip32xx/mtip32xx.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -4108,6 +4108,7 @@ static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv) 
	struct mtip_cmd *cmd;

	struct mtip_cmd *cmd;





	if (likely(!reserv)) {

	if (likely(!reserv)) {

		cmd = blk_mq_rq_to_pdu(rq);

		cmd->status = -ENODEV;

		cmd->status = -ENODEV;

		blk_mq_complete_request(rq);

		blk_mq_complete_request(rq);

	} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {

	} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {