From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Return-Path: Message-Id: <20120620173025.310860244@linuxfoundation.org> Date: Wed, 20 Jun 2012 10:31:11 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Sasha Levin , Eric Van Hensbergen Subject: [ 51/61] 9p: BUG before corrupting memory In-Reply-To: <20120620173033.GA5634@kroah.com> List-ID: 3.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sasha Levin commit 5fcb08befaf57faa1b00e514915c1660252b8c26 upstream. The BUG_ON() in pack_sg_list() would get triggered only one time after we've corrupted some memory by sg_set_buf() into an invalid sg buffer. I'm still working on figuring out why I manage to trigger that bug... Signed-off-by: Sasha Levin Signed-off-by: Eric Van Hensbergen Signed-off-by: Greg Kroah-Hartman --- net/9p/trans_virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/9p/trans_virtio.c +++ b/net/9p/trans_virtio.c @@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterli s = rest_of_page(data); if (s > count) s = count; + BUG_ON(index > limit); sg_set_buf(&sg[index++], data, s); count -= s; data += s; - BUG_ON(index > limit); } return index-start;