From 98fa6e45edc8f010a1252f8738761986eb5d8779 Mon Sep 17 00:00:00 2001
From: Matthew Wilcox <matthew.r.wilcox@intel.com>
Date: Sun, 6 Feb 2011 08:51:15 -0500
Subject: [PATCH] --- yaml --- r: 286250 b: refs/heads/master c:
 48e3d39816416b3bf03dee3a796c0c04427c1a31 h: refs/heads/master v: v3

---
 [refs]                     | 2 +-
 trunk/drivers/block/nvme.c | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 613bb90aa2ce..d243924ada1d 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b36235df01ec4141b4e589571d6789076c346d88
+refs/heads/master: 48e3d39816416b3bf03dee3a796c0c04427c1a31
diff --git a/trunk/drivers/block/nvme.c b/trunk/drivers/block/nvme.c
index 2dd09e7e142d..f4085d4fe0f2 100644
--- a/trunk/drivers/block/nvme.c
+++ b/trunk/drivers/block/nvme.c
@@ -170,12 +170,15 @@ enum {
 #define CMD_CTX_BASE		(POISON_POINTER_DELTA + sync_completion_id)
 #define CMD_CTX_CANCELLED	(0x2008 + CMD_CTX_BASE)
 #define CMD_CTX_COMPLETED	(0x2010 + CMD_CTX_BASE)
+#define CMD_CTX_INVALID		(0x2014 + CMD_CTX_BASE)
 
 static unsigned long free_cmdid(struct nvme_queue *nvmeq, int cmdid)
 {
 	unsigned long data;
 	unsigned offset = cmdid + BITS_TO_LONGS(nvmeq->q_depth);
 
+	if (cmdid > nvmeq->q_depth)
+		return CMD_CTX_INVALID;
 	data = nvmeq->cmdid_data[offset];
 	nvmeq->cmdid_data[offset] = CMD_CTX_COMPLETED;
 	clear_bit(cmdid, nvmeq->cmdid_data);
@@ -411,6 +414,12 @@ static void sync_completion(struct nvme_queue *nvmeq, void *ctx,
 				cqe->command_id, le16_to_cpup(&cqe->sq_id));
 		return;
 	}
+	if (unlikely((unsigned long)cmdinfo == CMD_CTX_INVALID)) {
+		dev_warn(nvmeq->q_dmadev,
+				"invalid id %d completed on queue %d\n",
+				cqe->command_id, le16_to_cpup(&cqe->sq_id));
+		return;
+	}
 	cmdinfo->result = le32_to_cpup(&cqe->result);
 	cmdinfo->status = le16_to_cpup(&cqe->status) >> 1;
 	wake_up_process(cmdinfo->task);