Commit d396b445 authored by Nathan Claudel's avatar Nathan Claudel Committed by Tomasz Zawadzki
Browse files

bdev/error: fix out-of-bound access to error vector 



The error vector should not be accessed beyond `SPDK_BDEV_IO_TYPE_RESET`.
Using the I/O type as an index in the I/O path creates out-of-bound accesses for any I/O type beyond RESET submitted to the error bdev.

Use the return value of `vbdev_error_get_error_type` (which does this properly) to guard against illegal access.

Change-Id: Idf66946a89866458b233aa08f296060eb77f5f0f
Signed-off-by: default avatarNathan Claudel <nathan.claudel@kalrayinc.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/22167


Reviewed-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarTomasz Zawadzki <tomasz.zawadzki@intel.com>
Community-CI: Mellanox Build Bot
parent ce5116fb

module/bdev/error/vbdev_error.c

+1 −1
Original line number Diff line number Diff line
@@ -250,7 +250,7 @@ vbdev_error_submit_request(struct spdk_io_channel *_ch, struct spdk_bdev_io *bde 


	error_type = vbdev_error_get_error_type(error_disk, bdev_io->type);



	if (ch->io_inflight < error_disk->error_vector[bdev_io->type].error_qd) {

	if (error_type != 0 && ch->io_inflight < error_disk->error_vector[bdev_io->type].error_qd) {

		error_type = 0;

	}