Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9d225ab3 authored by Dan Carpenter's avatar Dan Carpenter Committed by Laura Abbott
Browse files

lib/scatterlist: error handling in __sg_alloc_table() 



I was reviewing code which I suspected might allocate a zero size SG
table.  That will cause memory corruption.  Also we can't return before
doing the memset or we could end up using uninitialized memory in the
cleanup path.

Change-Id: Icee6be8ea22644d7f16264d9d2a0887c7145996b
CRs-Fixed: 611562
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Git-commit: 27daabd9b6a157c34a6e7a7f509fa26866e6420f
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


Signed-off-by: default avatarLaura Abbott <lauraa@codeaurora.org>
parent 9c6389a6

lib/scatterlist.c

+4 −2
Original line number Diff line number Diff line
@@ -247,13 +247,15 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents, 
	struct scatterlist *sg, *prv;

	unsigned int left;



	memset(table, 0, sizeof(*table));



	if (nents == 0)

		return -EINVAL;

#ifndef ARCH_HAS_SG_CHAIN

	if (WARN_ON_ONCE(nents > max_ents))

		return -EINVAL;

#endif



	memset(table, 0, sizeof(*table));



	left = nents;

	prv = NULL;

	do {