Commit 27daabd9 authored by Dan Carpenter's avatar Dan Carpenter Committed by Linus Torvalds
Browse files

lib/scatterlist: error handling in __sg_alloc_table()

I was reviewing code which I suspected might allocate a zero size SG
table.  That will cause memory corruption.  Also we can't return before
doing the memset or we could end up using uninitialized memory in the
cleanup path.
Signed-off-by: default avatarDan Carpenter <>
Cc: Akinobu Mita <>
Cc: Imre Deak <>
Cc: Tejun Heo <>
Cc: Daniel Vetter <>
Cc: Maxim Levitsky <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent a4517511
......@@ -247,13 +247,15 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
struct scatterlist *sg, *prv;
unsigned int left;
memset(table, 0, sizeof(*table));
if (nents == 0)
return -EINVAL;
if (WARN_ON_ONCE(nents > max_ents))
return -EINVAL;
memset(table, 0, sizeof(*table));
left = nents;
prv = NULL;
do {
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment