net/9p: Modify the problem of BUG_ON judgment
Subsystems (3)
PATCH 1/1 net/9p: Modify the problem of BUG_ON judgment
Because the value of limit is VIRTQUEUE_NUM, if index is equal to limit, it will cause sg array out of bounds, so correct the judgement of BUG_ON.
--- net/9p/trans_virtio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/9p/trans_virtio.c +2 -1
@@ -191,7 +191,7 @@ static int pack_sg_list(struct scatterlist *sg, int start, s =rest_of_page (data);if (s > count) s = count; -BUG_ON (index > limit); +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_buf (&sg[index++], data, s);
@@ -236,6 +236,7 @@ static int p9_virtio_cancel(struct p9_client *client, struct p9_req_t *req) s =PAGE_SIZE - data_off;if (s > count) s = count; +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_page (&sg[index++], pdata[i++], s, data_off);
Signature · 1 line
1.8.3.1
Dominique Martinet
maintainerjiangyiwen wrote on Fri, Aug 03, 2018:
Quoted 5 lines
Because the value of limit is
VIRTQUEUE_NUM, if index is equal to limit, it will cause sg array out of bounds, so correct the judgement ofBUG_ON.Signed-off-by Yiwen Jiang <[email protected]>
I'm not sure you've acted on his mail or if you found this independantly, but this was reported by Dan Carpenter on the list in June.
Would you mind if I add a tag for him?
That aside this looks good, I'll take it.
Quoted 25 lines
--- net/9p/trans_virtio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)net/9p/trans_virtio.c +2
-1@@ -191,7 +191,7 @@ static int pack_sg_list(struct scatterlist *sg, int start, s =rest_of_page (data);if (s > count) s = count; -BUG_ON (index > limit); +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_buf (&sg[index++], data, s);@@ -236,6 +236,7 @@ static int p9_virtio_cancel(struct p9_client *client, struct p9_req_t *req) s =PAGE_SIZE - data_off;if (s > count) s = count; +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_page (&sg[index++], pdata[i++], s, data_off);
Signature · 1 line
Dominique Martinet
Quoted 7 lines · Dominique Martinet
jiangyiwen wrote on Fri, Aug 03, 2018:
Quoted 5 lines
Because the value of limit is
VIRTQUEUE_NUM, if index is equal to limit, it will cause sg array out of bounds, so correct the judgement ofBUG_ON.Signed-off-by Yiwen Jiang <[email protected]>
Quoted 8 lines
I'm not sure you've acted on his mail or if you found this independantly, but this was reported by Dan Carpenter on the list in June.
Would you mind if I add a tag for him?Reported-by Dan Carpenter <[email protected]>That aside this looks good, I'll take it.
Sorry, I didn't see it before, I tested this problem a few days ago. It is true that this problem was discovered first by him. Thank you for adding him.
Quoted 26 lines
Quoted 25 lines
--- net/9p/trans_virtio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)net/9p/trans_virtio.c +2
-1@@ -191,7 +191,7 @@ static int pack_sg_list(struct scatterlist *sg, int start, s =rest_of_page (data);if (s > count) s = count; -BUG_ON (index > limit); +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_buf (&sg[index++], data, s);@@ -236,6 +236,7 @@ static int p9_virtio_cancel(struct p9_client *client, struct p9_req_t *req) s =PAGE_SIZE - data_off;if (s > count) s = count; +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_page (&sg[index++], pdata[i++], s, data_off);
LGTM
Quoted 5 lines · jiangyiwen
Because the value of limit is
VIRTQUEUE_NUM, if index is equal to limit, it will cause sg array out of bounds, so correct the judgement ofBUG_ON.Signed-off-by Yiwen Jiang <[email protected]>
Quoted 26 lines
--- net/9p/trans_virtio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)net/9p/trans_virtio.c +2
-1@@ -191,7 +191,7 @@ static int pack_sg_list(struct scatterlist *sg, int start, s =rest_of_page (data);if (s > count) s = count; -BUG_ON (index > limit); +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_buf (&sg[index++], data, s);@@ -236,6 +236,7 @@ static int p9_virtio_cancel(struct p9_client *client, struct p9_req_t *req) s =PAGE_SIZE - data_off;if (s > count) s = count; +BUG_ON (index >= limit);/* Make sure we don't terminate early. */ sg_unmark_end (&sg[index]);sg_set_page (&sg[index++], pdata[i++], s, data_off);