Commit 5fcb08be authored by Sasha Levin's avatar Sasha Levin Committed by Eric Van Hensbergen

9p: BUG before corrupting memory

The BUG_ON() in pack_sg_list() would get triggered only one time after we've
corrupted some memory by sg_set_buf() into an invalid sg buffer.

I'm still working on figuring out why I manage to trigger that bug...
Signed-off-by: default avatarSasha Levin <levinsasha928@gmail.com>
Signed-off-by: default avatarEric Van Hensbergen <ericvh@gmail.com>
parent 4e3c8a1b
...@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start, ...@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start,
s = rest_of_page(data); s = rest_of_page(data);
if (s > count) if (s > count)
s = count; s = count;
BUG_ON(index > limit);
sg_set_buf(&sg[index++], data, s); sg_set_buf(&sg[index++], data, s);
count -= s; count -= s;
data += s; data += s;
BUG_ON(index > limit);
} }
return index-start; return index-start;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment