blk-mq: add bounds check on tag-to-rq conversion

hreinecke · axboe · commit 4ee86babe09f · 2016-03-15T12:03:28.000-07:00
We need to check for a valid index before accessing the array
element to avoid accessing invalid memory regions.

Reviewed-by: Christoph Hellwig &lt;hch@lst.de&gt;
Reviewed-by: Jeff Moyer &lt;jmoyer@redhat.com&gt;

Modified by Jens to drop the unlikely(), and make the fall through
path be having a valid tag.

Signed-off-by: Jens Axboe &lt;axboe@fb.com&gt;
diff --git a/block/blk-mq.c b/block/blk-mq.c
@@ -544,7 +544,10 @@ EXPORT_SYMBOL(blk_mq_abort_requeue_list);
 
 struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag)
 {
-	return tags->rqs[tag];
+	if (tag < tags->nr_tags)
+		return tags->rqs[tag];
+
+	return NULL;
 }
 EXPORT_SYMBOL(blk_mq_tag_to_rq);
 

Original file line number	Diff line number	Diff line change
`@@ -544,7 +544,10 @@ EXPORT_SYMBOL(blk_mq_abort_requeue_list);`
`544`	`544`
`545`	`545`	`struct request blk_mq_tag_to_rq(struct blk_mq_tags tags, unsigned int tag)`
`546`	`546`	`{`
`547`		`- return tags->rqs[tag];`
	`547`	`+ if (tag < tags->nr_tags)`
	`548`	`+ return tags->rqs[tag];`
	`549`	`+`
	`550`	`+ return NULL;`
`548`	`551`	`}`
`549`	`552`	`EXPORT_SYMBOL(blk_mq_tag_to_rq);`
`550`	`553`