Commit d0e27c88 authored by Yi Zou's avatar Yi Zou Committed by Nicholas Bellinger

target: fix NULL pointer dereference bug alloc_page() fails to get memory

I am hitting this bug when the target is low in memory that fails the
alloc_page() for the newly submitted command. This is a sort of off-by-one
bug causing NULL pointer dereference in __free_page() since 'i' here is
really the counter of total pages that have been successfully allocated here.
Signed-off-by: default avatarYi Zou <yi.zou@intel.com>
Cc: Andy Grover <agrover@redhat.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Open-FCoE.org <devel@open-fcoe.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 1fa8f450
...@@ -2294,9 +2294,9 @@ transport_generic_get_mem(struct se_cmd *cmd) ...@@ -2294,9 +2294,9 @@ transport_generic_get_mem(struct se_cmd *cmd)
return 0; return 0;
out: out:
while (i >= 0) { while (i > 0) {
__free_page(sg_page(&cmd->t_data_sg[i]));
i--; i--;
__free_page(sg_page(&cmd->t_data_sg[i]));
} }
kfree(cmd->t_data_sg); kfree(cmd->t_data_sg);
cmd->t_data_sg = NULL; cmd->t_data_sg = NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment