redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

blk-mq-debugfs: Off by one in blk_mq_rq_state_name() 

If rq_state == ARRAY_SIZE() then we read one element beyond the end of
the blk_mq_rq_state_name_array[] array.

Fixes: ec6dcf63c5 ("blk-mq-debugfs: Show more request state information")
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
hifive-unleashed-5.1
Dan Carpenter 2018-06-20 13:45:05 +03:00 committed by Jens Axboe
parent 9c24c10a2c
commit a1e7918862
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
block/blk-mq-debugfs.c
View File

@ -356,7 +356,7 @@ static const char *const blk_mq_rq_state_name_array[] = {
static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)
{
if (WARN_ON_ONCE((unsigned int)rq_state >
if (WARN_ON_ONCE((unsigned int)rq_state >=
ARRAY_SIZE(blk_mq_rq_state_name_array)))
return "(?)";
return blk_mq_rq_state_name_array[rq_state];