LinuxKPI: fix sg_pcopy_from_buffer()
In sg_pcopy_from_buffer() is an error in that skip can underflow and lead to bogus page arithmetics which may lead to memory corruption or more likely panics. Once we found a s/g page to copy into there is nothing to skip anymore so simply set skip to 0. Sponsored by: The FreeBSD Foundation MFC after: 5 days Reviewed by: hselasky Differential Revision: https://reviews.freebsd.org/D30676
This commit is contained in:
parent
d4a4960c65
commit
edfcdffefc
@ -520,12 +520,13 @@ sg_pcopy_from_buffer(struct scatterlist *sgl, unsigned int nents,
|
||||
memcpy(p, b, len);
|
||||
sf_buf_free(sf);
|
||||
|
||||
/* We copied so nothing more to skip. */
|
||||
skip = 0;
|
||||
copied += len;
|
||||
/* Either we exactly filled the page, or we are done. */
|
||||
buflen -= len;
|
||||
if (buflen == 0)
|
||||
break;
|
||||
skip -= len;
|
||||
b += len;
|
||||
}
|
||||
sched_unpin();
|
||||
|
Loading…
Reference in New Issue
Block a user