From: Jens Axboe <axboe@fb.com>
Date: Fri, 21 Apr 2017 14:46:44 +0000 (-0600)
Subject: mtip32xx: fix dereference of stack garbage
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=95c55ff425faa190fd8ba55090fbdf33d8b2f0ae;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

mtip32xx: fix dereference of stack garbage

We need to get the command payload from the request before
we attempt to dereference it.

Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
---

diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 66a6bd83faae..54c8736038de 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4108,6 +4108,7 @@ static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
 	struct mtip_cmd *cmd;
 
 	if (likely(!reserv)) {
+		cmd = blk_mq_rq_to_pdu(rq);
 		cmd->status = -ENODEV;
 		blk_mq_complete_request(rq);
 	} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {