Patchwork 9p: BUG before corrupting memory

login
register
mail settings
Submitter Sasha Levin
Date May 28, 2012, 4 p.m.
Message ID <1338220845-25082-1-git-send-email-levinsasha928@gmail.com>
Download mbox | patch
Permalink /patch/161627/
State Not Applicable
Delegated to: David Miller
Headers show

Comments

Sasha Levin - May 28, 2012, 4 p.m.
The BUG_ON() in pack_sg_list() would get triggered only one time after we've
corrupted some memory by sg_set_buf() into an invalid sg buffer.

I'm still working on figuring out why I manage to trigger that bug...

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
---
 net/9p/trans_virtio.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Patch

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 5af18d1..2fd7305 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -192,10 +192,10 @@  static int pack_sg_list(struct scatterlist *sg, int start,
 		s = rest_of_page(data);
 		if (s > count)
 			s = count;
+		BUG_ON(index >= limit);
 		sg_set_buf(&sg[index++], data, s);
 		count -= s;
 		data += s;
-		BUG_ON(index > limit);
 	}
 
 	return index-start;