9p: BUG before corrupting memory

The BUG_ON() in pack_sg_list() would get triggered only one time after we've
corrupted some memory by sg_set_buf() into an invalid sg buffer.

I'm still working on figuring out why I manage to trigger that bug...

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 5af18d11b518..2a167658bb95 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start,
                 s = rest_of_page(data);
                 if (s > count)
                         s = count;
+                BUG_ON(index > limit);
                 sg_set_buf(&sg[index++], data, s);
                 count -= s;
                 data += s;
-                BUG_ON(index > limit);
         }
 
         return index-start;