Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-31 23:31:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

blk-mq-debugfs: Off by one in blk_mq_rq_state_name()

Browse Source 
If rq_state == ARRAY_SIZE() then we read one element beyond the end of
the blk_mq_rq_state_name_array[] array.

Fixes: ec6dcf63c5 ("blk-mq-debugfs: Show more request state information")
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Dan Carpenter 2018-06-20 13:45:05 +03:00 committed by Jens Axboe
parent 9c24c10a2c
commit a1e7918862
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
block/blk-mq-debugfs.c
View File

@ -356,7 +356,7 @@ static const char *const blk_mq_rq_state_name_array[] = {
static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state) static const char *blk_mq_rq_state_name(enum mq_rq_state rq_state)
{ {
if (WARN_ON_ONCE((unsigned int)rq_state > if (WARN_ON_ONCE((unsigned int)rq_state >=
ARRAY_SIZE(blk_mq_rq_state_name_array))) ARRAY_SIZE(blk_mq_rq_state_name_array)))
return "(?)"; return "(?)";
return blk_mq_rq_state_name_array[rq_state]; return blk_mq_rq_state_name_array[rq_state];