If param->length is zero, then this could lead to a divide by zero bug later in the function when we do: size %= max; Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@@ -423,6 +423,9 @@ alloc_sglist(int nents, int max, int vary)
unsigned i;
unsigned size = max;
+ if (max == 0)
+ return NULL;
+
sg = kmalloc_array(nents, sizeof *sg, GFP_KERNEL);
if (!sg)
return NULL;