9p: BUG before corrupting memory
authorSasha Levin <levinsasha928@gmail.com>
Mon, 11 Jun 2012 15:18:13 +0000 (10:18 -0500)
committerEric Van Hensbergen <ericvh@gmail.com>
Mon, 11 Jun 2012 15:29:07 +0000 (10:29 -0500)
The BUG_ON() in pack_sg_list() would get triggered only one time after we've
corrupted some memory by sg_set_buf() into an invalid sg buffer.

I'm still working on figuring out why I manage to trigger that bug...

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
net/9p/trans_virtio.c

index 5af18d11b5184805bf7a01c5d94d0759b21c4992..2a167658bb958ae3a302bd80a46649416c697183 100644 (file)
@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start,
                s = rest_of_page(data);
                if (s > count)
                        s = count;
+               BUG_ON(index > limit);
                sg_set_buf(&sg[index++], data, s);
                count -= s;
                data += s;
-               BUG_ON(index > limit);
        }
 
        return index-start;