9p: BUG before corrupting memory

The BUG_ON() in pack_sg_list() would get triggered only one time after we've corrupted some memory by sg_set_buf() into an invalid sg buffer. I'm still working on figuring out why I manage to trigger that bug... Signed-off-by: Sasha Levin <[email protected]> Signed-off-by: Eric Van Hensbergen <[email protected]>
kyagi · Jun 11, 2012 · 5fcb08b · 5fcb08b
1 parent 4e3c8a1
commit 5fcb08b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start,
 		s = rest_of_page(data);
 		if (s > count)
 			s = count;
+		BUG_ON(index > limit);
 		sg_set_buf(&sg[index++], data, s);
 		count -= s;
 		data += s;
-		BUG_ON(index > limit);
 	}
 
 	return index-start;