Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5fcb08be authored by Sasha Levin's avatar Sasha Levin Committed by Eric Van Hensbergen
Browse files

9p: BUG before corrupting memory 



The BUG_ON() in pack_sg_list() would get triggered only one time after we've
corrupted some memory by sg_set_buf() into an invalid sg buffer.

I'm still working on figuring out why I manage to trigger that bug...

Signed-off-by: default avatarSasha Levin <levinsasha928@gmail.com>
Signed-off-by: default avatarEric Van Hensbergen <ericvh@gmail.com>
parent 4e3c8a1b

net/9p/trans_virtio.c

+1 −1
Original line number Diff line number Diff line
@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start, 
		s = rest_of_page(data);

		if (s > count)

			s = count;

		BUG_ON(index > limit);

		sg_set_buf(&sg[index++], data, s);

		count -= s;

		data += s;

		BUG_ON(index > limit);

	}



	return index-start;