nvme: Fix discard buffer overrun

Web:        https://git.kernel.org/torvalds/c/8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae
Commit:     8cb6af7b3a6d47f95ecb461a3f8d39cf6a64e4ae
Parent:     3096a739d2ccbfd6a626e388228a16558f76d79d
Refname:    refs/heads/master
Author:     Keith Busch <[email protected]>
AuthorDate: Wed Jan 31 17:01:58 2018 -0700
Committer:  Sagi Grimberg <[email protected]>
CommitDate: Thu Feb 8 18:35:55 2018 +0200

    nvme: Fix discard buffer overrun
    
    This patch checks the discard range array bounds before setting it in
    case the driver gets a badly formed request.
    
    Signed-off-by: Keith Busch <[email protected]>
    Reviewed-by: Jens Axboe <[email protected]>
    Signed-off-by: Sagi Grimberg <[email protected]>
---
 drivers/nvme/host/core.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 1f9278364196..2fd8688cfa47 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -518,9 +518,11 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
 		u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
 		u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift;
 
-		range[n].cattr = cpu_to_le32(0);
-		range[n].nlb = cpu_to_le32(nlb);
-		range[n].slba = cpu_to_le64(slba);
+		if (n < segments) {
+			range[n].cattr = cpu_to_le32(0);
+			range[n].nlb = cpu_to_le32(nlb);
+			range[n].slba = cpu_to_le64(slba);
+		}
 		n++;
 	}
 
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html