Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755876Ab0H3QGA (ORCPT ); Mon, 30 Aug 2010 12:06:00 -0400 Received: from mail128.messagelabs.com ([216.82.250.131]:25291 "EHLO mail128.messagelabs.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755693Ab0H3QF7 (ORCPT ); Mon, 30 Aug 2010 12:05:59 -0400 X-VirusChecked: Checked X-Env-Sender: jcarlyle@motorola.com X-Msg-Ref: server-6.tower-128.messagelabs.com!1283184358!8120198!1 X-StarScan-Version: 6.2.4; banners=-,-,- X-Originating-IP: [129.188.136.8] In-Reply-To: <20100830160147.DE515603843@il93ubuntu.localdomain> References: <20100830160147.DE515603843@il93ubuntu.localdomain> From: Jeffrey Carlyle To: Tejun Heo Date: Mon, 30 Aug 2010 11:04:15 -0500 Subject: [PATCH v4] scatterlist: prevent invalid free when alloc fails Cc: OLUSANYA SOYANNWO , , Hu Tao , , , Jeffrey Carlyle Message-Id: <20100830160556.7F840603843@il93ubuntu.localdomain> X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1546 Lines: 46 When alloc fails, free_table is being called. Depending on the number of bytes requested, we determine if we are going to call _get_free_page() or kmalloc(). When alloc fails, our math is wrong (due to sg_size - 1), and the last buffer is wrongfully assumed to have been allocated by kmalloc. Hence, kfree gets called and a panic occurs. Signed-off-by: Jeffrey Carlyle Signed-off-by: Olusanya Soyannwo Cc: Tejun Heo Cc: Jens Axboe --- lib/scatterlist.c | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/lib/scatterlist.c b/lib/scatterlist.c index a5ec428..a654897 100644 --- a/lib/scatterlist.c +++ b/lib/scatterlist.c @@ -248,8 +248,18 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents, left -= sg_size; sg = alloc_fn(alloc_size, gfp_mask); - if (unlikely(!sg)) + if (unlikely(!sg)) { + /* + * Adjust entry count to reflect that the last + * entry of the previous table won't be used for + * linkage. Without this, sg_kfree() may get + * confused. + */ + if(pvr) + table->nents = ++table->orig_nents; + return -ENOMEM; + } sg_init_table(sg, alloc_size); table->nents = table->orig_nents += sg_size; -- 1.6.3.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/