lkml.org 
[lkml]   [2012]   [Jun]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 51/61] 9p: BUG before corrupting memory
    3.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sasha Levin <levinsasha928@gmail.com>

    commit 5fcb08befaf57faa1b00e514915c1660252b8c26 upstream.

    The BUG_ON() in pack_sg_list() would get triggered only one time after we've
    corrupted some memory by sg_set_buf() into an invalid sg buffer.

    I'm still working on figuring out why I manage to trigger that bug...

    Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/9p/trans_virtio.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/9p/trans_virtio.c
    +++ b/net/9p/trans_virtio.c
    @@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterli
    s = rest_of_page(data);
    if (s > count)
    s = count;
    + BUG_ON(index > limit);
    sg_set_buf(&sg[index++], data, s);
    count -= s;
    data += s;
    - BUG_ON(index > limit);
    }

    return index-start;



    \
     
     \ /
      Last update: 2012-06-20 21:22    [W:0.027 / U:89.964 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site