diff options
author | Jeffrey Carlyle <jeff.carlyle@motorola.com> | 2010-08-30 19:55:09 +0200 |
---|---|---|
committer | Jens Axboe <jaxboe@fusionio.com> | 2010-08-30 19:55:09 +0200 |
commit | edce6820a9fdda85521211cb334a183e34cc455e (patch) | |
tree | c2944c0a6e175cd089dde7b808398763ae5c50dd /block | |
parent | b76b4014f9d988d2412b873e4d4c13c7f9afc4e4 (diff) | |
download | linux-edce6820a9fdda85521211cb334a183e34cc455e.tar.gz linux-edce6820a9fdda85521211cb334a183e34cc455e.tar.bz2 linux-edce6820a9fdda85521211cb334a183e34cc455e.zip |
scatterlist: prevent invalid free when alloc fails
When alloc fails, free_table is being called. Depending on the number of
bytes requested, we determine if we are going to call _get_free_page()
or kmalloc(). When alloc fails, our math is wrong (due to sg_size - 1),
and the last buffer is wrongfully assumed to have been allocated by
kmalloc. Hence, kfree gets called and a panic occurs.
Signed-off-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>
Signed-off-by: Olusanya Soyannwo <c23746@motorola.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Diffstat (limited to 'block')
0 files changed, 0 insertions, 0 deletions