diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2017-05-09 09:01:21 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-05-09 09:01:21 -0700 |
| commit | 339fbf6796f8e74544091adbf511286768eaf93e (patch) | |
| tree | 12840783d0eb70d1a7ecd13c3a7fab5b69b0a2b6 | |
| parent | 8ee74a91ac304ad2e9e794eb96ed76f0634dec40 (diff) | |
| parent | 5b47d59af68a8735e4637bacedcb4baf6f47c73f (diff) | |
Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs fix from Al Viro:
"Braino fix for iov_iter_revert() misuse"
* 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
fix braino in generic_file_read_iter()
| -rw-r--r-- | lib/iov_iter.c | 2 | ||||
| -rw-r--r-- | mm/filemap.c | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/lib/iov_iter.c b/lib/iov_iter.c index ae82d9cea553..f835964c9485 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -790,6 +790,8 @@ void iov_iter_revert(struct iov_iter *i, size_t unroll) { if (!unroll) return; + if (WARN_ON(unroll > MAX_RW_COUNT)) + return; i->count += unroll; if (unlikely(i->type & ITER_PIPE)) { struct pipe_inode_info *pipe = i->pipe; diff --git a/mm/filemap.c b/mm/filemap.c index b7b973b47d8d..6f1be573a5e6 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2050,7 +2050,7 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) iocb->ki_pos += retval; count -= retval; } - iov_iter_revert(iter, iov_iter_count(iter) - count); + iov_iter_revert(iter, count - iov_iter_count(iter)); /* * Btrfs can have a short DIO read if we encounter |