target: fix NULL pointer dereference bug alloc_page() fails to get memory
authorYi Zou <yi.zou@intel.com>
Tue, 14 Aug 2012 23:06:43 +0000 (16:06 -0700)
committerNicholas Bellinger <nab@linux-iscsi.org>
Fri, 17 Aug 2012 00:33:46 +0000 (17:33 -0700)
I am hitting this bug when the target is low in memory that fails the
alloc_page() for the newly submitted command. This is a sort of off-by-one
bug causing NULL pointer dereference in __free_page() since 'i' here is
really the counter of total pages that have been successfully allocated here.

Signed-off-by: Yi Zou <yi.zou@intel.com>
Cc: Andy Grover <agrover@redhat.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Open-FCoE.org <devel@open-fcoe.org>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
drivers/target/target_core_transport.c

index 0eaae23d12b576547fa51f25ed8f05579f6ec646..a7589ccdb6f3373a870fc0c4c828ebfe872a67dd 100644 (file)
@@ -2294,9 +2294,9 @@ transport_generic_get_mem(struct se_cmd *cmd)
        return 0;
 
 out:
-       while (i >= 0) {
-               __free_page(sg_page(&cmd->t_data_sg[i]));
+       while (i > 0) {
                i--;
+               __free_page(sg_page(&cmd->t_data_sg[i]));
        }
        kfree(cmd->t_data_sg);
        cmd->t_data_sg = NULL;