A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

target: fix NULL pointer dereference bug alloc_page() fails to get memory

Browse source 
I am hitting this bug when the target is low in memory that fails the
alloc_page() for the newly submitted command. This is a sort of off-by-one
bug causing NULL pointer dereference in __free_page() since 'i' here is
really the counter of total pages that have been successfully allocated here.

Signed-off-by: Yi Zou <[email protected]>
Cc: Andy Grover <[email protected]>
Cc: Nicholas Bellinger <[email protected]>
Cc: Open-FCoE.org <[email protected]>
Cc: [email protected]
Signed-off-by: Nicholas Bellinger <[email protected]>
This commit is contained in:
Yi Zou 2012-08-14 16:06:43 -07:00 • committed by Nicholas Bellinger
commit d0e27c88d7
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/target/target_core_transport.c
View file

@ -2294,9 +2294,9 @@ transport_generic_get_mem(struct se_cmd *cmd)
return 0;
out:
while (i >= 0) {
__free_page(sg_page(&cmd->t_data_sg[i]));
while (i > 0) {
i--;
__free_page(sg_page(&cmd->t_data_sg[i]));
}
kfree(cmd->t_data_sg);
cmd->t_data_sg = NULL;