9p: BUG before corrupting memory
The BUG_ON() in pack_sg_list() would get triggered only one time after we've corrupted some memory by sg_set_buf() into an invalid sg buffer. I'm still working on figuring out why I manage to trigger that bug... Signed-off-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
This commit is contained in:
parent
4e3c8a1b1c
commit
5fcb08befa
|
@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start,
|
||||||
s = rest_of_page(data);
|
s = rest_of_page(data);
|
||||||
if (s > count)
|
if (s > count)
|
||||||
s = count;
|
s = count;
|
||||||
|
BUG_ON(index > limit);
|
||||||
sg_set_buf(&sg[index++], data, s);
|
sg_set_buf(&sg[index++], data, s);
|
||||||
count -= s;
|
count -= s;
|
||||||
data += s;
|
data += s;
|
||||||
BUG_ON(index > limit);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return index-start;
|
return index-start;
|
||||||
|
|
Reference in New Issue