summaryrefslogtreecommitdiff
path: root/drivers/block/mtip32xx
diff options
context:
space:
mode:
authorJens Axboe <axboe@fb.com>2017-04-21 08:46:44 -0600
committerJens Axboe <axboe@fb.com>2017-04-21 08:46:44 -0600
commit95c55ff425faa190fd8ba55090fbdf33d8b2f0ae (patch)
treeed110696e538cbe27f2e589f44fb7adf9f9ca35c /drivers/block/mtip32xx
parent99c749a4c4f4ea2c9eee01f81f79bdbf26c3914e (diff)
mtip32xx: fix dereference of stack garbage
We need to get the command payload from the request before we attempt to dereference it. Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd") Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'drivers/block/mtip32xx')
-rw-r--r--drivers/block/mtip32xx/mtip32xx.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 66a6bd83faae..54c8736038de 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4108,6 +4108,7 @@ static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
struct mtip_cmd *cmd;
if (likely(!reserv)) {
+ cmd = blk_mq_rq_to_pdu(rq);
cmd->status = -ENODEV;
blk_mq_complete_request(rq);
} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {