On Tue, 2012-08-14 at 16:06 -0700, Yi Zou wrote:
> I am hitting this bug when the target is low in memory that fails the
> alloc_page() for the newly submitted command. This is a sort of off-by-one
> bug causing NULL pointer dereference in __free_page() since 'i' here is
> really the counter of total pages that have been successfully allocated here.
>
> Signed-off-by: Yi Zou <yi.zou@xxxxxxxxx>
> Cc: Andy Grover <agrover@xxxxxxxxxx>
> Cc: Nicholas Bellinger <nab@xxxxxxxxxxxxxxx>
> Cc: Open-FCoE.org <devel@xxxxxxxxxxxxx>
> ---
>
> drivers/target/target_core_transport.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
Very good catch here. Adding a CC' stable for this one as well..
This has been added to target-pending/queue for the moment, and I’ll
include it into master along with other 3.6-rc-fixes as soon as Linus
cuts -rc2.
Thanks Yi!
--nab
> diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
> index 0eaae23..a7589cc 100644
> --- a/drivers/target/target_core_transport.c
> +++ b/drivers/target/target_core_transport.c
> @@ -2294,9 +2294,9 @@ transport_generic_get_mem(struct se_cmd *cmd)
> return 0;
>
> out:
> - while (i >= 0) {
> - __free_page(sg_page(&cmd->t_data_sg[i]));
> + while (i > 0) {
> i--;
> + __free_page(sg_page(&cmd->t_data_sg[i]));
> }
> kfree(cmd->t_data_sg);
> cmd->t_data_sg = NULL;
>
--
To unsubscribe from this list: send the line "unsubscribe target-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
