2007-12-06 06:26:58

by Joy Latten

Subject: scatterwalk_map_and_copy may cause kernel oops

In scatterwalk_map_and_copy(), sg_next(sg) is called,
loop goes back to top and scatterwalk_start() gets called
again. When next sg is NULL, BUG_ON may occur in next call to
scatterwalk_start().

Please let me know if following patch takes
right approach to fix this.

regards,
Joy

Signed-off-by: Joy Latten <[email protected]>


diff -urpN cryptodev-2.6.2/crypto/scatterwalk.c cryptodev-2.6.2.sandbox/crypto/scatterwalk.c
--- cryptodev-2.6.2/crypto/scatterwalk.c 2007-12-05 00:23:37.000000000 -0600
+++ cryptodev-2.6.2.sandbox/crypto/scatterwalk.c 2007-12-06 00:10:56.000000000 -0600
@@ -106,7 +106,7 @@ void scatterwalk_map_and_copy(void *buf,
struct scatter_walk walk;
unsigned int offset = 0;

- for (;;) {
+ do {
scatterwalk_start(&walk, sg);

if (start < offset + sg->length)
@@ -114,7 +114,7 @@ void scatterwalk_map_and_copy(void *buf,

offset += sg->length;
sg = sg_next(sg);
- }
+ } while (sg != NULL);

scatterwalk_advance(&walk, start - offset);
scatterwalk_copychunks(buf, &walk, nbytes, out);

2007-12-07 09:23:36

by Herbert Xu

Subject: Re: scatterwalk_map_and_copy may cause kernel oops

On Thu, Dec 06, 2007 at 12:25:57AM -0600, Joy Latten wrote:
> In scatterwalk_map_and_copy(), sg_next(sg) is called,
> loop goes back to top and scatterwalk_start() gets called
> again. When next sg is NULL, BUG_ON may occur in next call to
> scatterwalk_start().
>
> Please let me know if following patch takes
> right approach to fix this.

If it's NULL it means that the sg you're giving it doesn't have
sufficient data so you need to find out why that is the case.

Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt