This is a note to let you know that I've just added the patch titled
target: fix NULL pointer dereference bug alloc_page() fails to get memory
to the 3.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
target-fix-null-pointer-dereference-bug-alloc_page-fails-to-get-memory.patch
and it can be found in the queue-3.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From d0e27c88d795fb9647153063ec48051fd84e1731 Mon Sep 17 00:00:00 2001
From: Yi Zou <[email protected]>
Date: Tue, 14 Aug 2012 16:06:43 -0700
Subject: target: fix NULL pointer dereference bug alloc_page() fails to get
memory
From: Yi Zou <[email protected]>
commit d0e27c88d795fb9647153063ec48051fd84e1731 upstream.
I am hitting this bug when the target is low in memory that fails the
alloc_page() for the newly submitted command. This is a sort of off-by-one
bug causing NULL pointer dereference in __free_page() since 'i' here is
really the counter of total pages that have been successfully allocated here.
Signed-off-by: Yi Zou <[email protected]>
Cc: Andy Grover <[email protected]>
Cc: Nicholas Bellinger <[email protected]>
Cc: Open-FCoE.org <[email protected]>
Signed-off-by: Nicholas Bellinger <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/target/target_core_transport.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -3675,9 +3675,9 @@ transport_generic_get_mem(struct se_cmd
return 0;
out:
- while (i >= 0) {
- __free_page(sg_page(&cmd->t_data_sg[i]));
+ while (i > 0) {
i--;
+ __free_page(sg_page(&cmd->t_data_sg[i]));
}
kfree(cmd->t_data_sg);
cmd->t_data_sg = NULL;
Patches currently in stable-queue which might be from [email protected] are
queue-3.4/target-fix-null-pointer-dereference-bug-alloc_page-fails-to-get-memory.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
