Skip to content

Commit 27daabd

Browse files
Dan Carpentertorvalds
authored andcommitted
lib/scatterlist: error handling in __sg_alloc_table()
I was reviewing code which I suspected might allocate a zero size SG table. That will cause memory corruption. Also we can't return before doing the memset or we could end up using uninitialized memory in the cleanup path. Signed-off-by: Dan Carpenter <[email protected]> Cc: Akinobu Mita <[email protected]> Cc: Imre Deak <[email protected]> Cc: Tejun Heo <[email protected]> Cc: Daniel Vetter <[email protected]> Cc: Maxim Levitsky <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
1 parent a451751 commit 27daabd

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

lib/scatterlist.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,13 +247,15 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
247247
struct scatterlist *sg, *prv;
248248
unsigned int left;
249249

250+
memset(table, 0, sizeof(*table));
251+
252+
if (nents == 0)
253+
return -EINVAL;
250254
#ifndef ARCH_HAS_SG_CHAIN
251255
if (WARN_ON_ONCE(nents > max_ents))
252256
return -EINVAL;
253257
#endif
254258

255-
memset(table, 0, sizeof(*table));
256-
257259
left = nents;
258260
prv = NULL;
259261
do {

0 commit comments

Comments
 (0)