lkml.org 
[lkml]   [2018]   [Sep]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 052/145] 9p/virtio: fix off-by-one error in sg list bounds check
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: jiangyiwen <jiangyiwen@huawei.com>

    commit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream.

    Because the value of limit is VIRTQUEUE_NUM, if index is equal to
    limit, it will cause sg array out of bounds, so correct the judgement
    of BUG_ON.

    Link: http://lkml.kernel.org/r/5B63D5F6.6080109@huawei.com
    Signed-off-by: Yiwen Jiang <jiangyiwen@huawei.com>
    Reported-By: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Jun Piao <piaojun@huawei.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/9p/trans_virtio.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/net/9p/trans_virtio.c
    +++ b/net/9p/trans_virtio.c
    @@ -188,7 +188,7 @@ static int pack_sg_list(struct scatterli
    s = rest_of_page(data);
    if (s > count)
    s = count;
    - BUG_ON(index > limit);
    + BUG_ON(index >= limit);
    /* Make sure we don't terminate early. */
    sg_unmark_end(&sg[index]);
    sg_set_buf(&sg[index++], data, s);
    @@ -233,6 +233,7 @@ pack_sg_list_p(struct scatterlist *sg, i
    s = PAGE_SIZE - data_off;
    if (s > count)
    s = count;
    + BUG_ON(index >= limit);
    /* Make sure we don't terminate early. */
    sg_unmark_end(&sg[index]);
    sg_set_page(&sg[index++], pdata[i++], s, data_off);

    \
     
     \ /
      Last update: 2018-09-07 23:22    [W:3.375 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site