Commit daeba89d43af0fa469d38a4ccdc32fff8ca17c2e
1 parent
7180c4c9e0
Exists in
master
and in
39 other branches
SUNRPC: don't call flush_dcache_page() with an invalid pointer
Fix a problem in _copy_to_pages(), whereby it may call flush_dcache_page() with an invalid pointer due to the fact that 'pgto' gets incremented beyond the end of the page array. Fix is to exit the loop without this unnecessary increment of pgto. Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Showing 1 changed file with 6 additions and 3 deletions Side-by-side Diff
net/sunrpc/xdr.c
| ... | ... | @@ -244,7 +244,7 @@ |
| 244 | 244 | pgto = pages + (pgbase >> PAGE_CACHE_SHIFT); |
| 245 | 245 | pgbase &= ~PAGE_CACHE_MASK; |
| 246 | 246 | |
| 247 | - do { | |
| 247 | + for (;;) { | |
| 248 | 248 | copy = PAGE_CACHE_SIZE - pgbase; |
| 249 | 249 | if (copy > len) |
| 250 | 250 | copy = len; |
| ... | ... | @@ -253,6 +253,10 @@ |
| 253 | 253 | memcpy(vto + pgbase, p, copy); |
| 254 | 254 | kunmap_atomic(vto, KM_USER0); |
| 255 | 255 | |
| 256 | + len -= copy; | |
| 257 | + if (len == 0) | |
| 258 | + break; | |
| 259 | + | |
| 256 | 260 | pgbase += copy; |
| 257 | 261 | if (pgbase == PAGE_CACHE_SIZE) { |
| 258 | 262 | flush_dcache_page(*pgto); |
| ... | ... | @@ -260,8 +264,7 @@ |
| 260 | 264 | pgto++; |
| 261 | 265 | } |
| 262 | 266 | p += copy; |
| 263 | - | |
| 264 | - } while ((len -= copy) != 0); | |
| 267 | + } | |
| 265 | 268 | flush_dcache_page(*pgto); |
| 266 | 269 | } |
| 267 | 270 |