summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2008-07-30 22:20:18 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2008-08-01 12:43:13 -0700
commita6b79bb88e6682d2739aa5b4db7184038bbb32ce (patch)
treebf9b9aac26cc6c35ea59c339e473c171b1b6d704
parent293f49dd74ffd6a9c453f73f01e812bd4e3d9357 (diff)
Fix off-by-one error in iov_iter_advance()
commit 94ad374a0751f40d25e22e036c37f7263569d24c upstream The iov_iter_advance() function would look at the iov->iov_len entry even though it might have iterated over the whole array, and iov was pointing past the end. This would cause DEBUG_PAGEALLOC to trigger a kernel page fault if the allocation was at the end of a page, and the next page was unallocated. The quick fix is to just change the order of the tests: check that there is any iovec data left before we check the iov entry itself. Thanks to Alexey Dobriyan for finding this case, and testing the fix. Reported-and-tested-by: Alexey Dobriyan <adobriyan@gmail.com> Cc: Nick Piggin <npiggin@suse.de> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--mm/filemap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/filemap.c b/mm/filemap.c
index 1e6a7d34874f..4f32423a2a02 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1778,7 +1778,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
* The !iov->iov_len check ensures we skip over unlikely
* zero-length segments (without overruning the iovec).
*/
- while (bytes || unlikely(!iov->iov_len && i->count)) {
+ while (bytes || unlikely(i->count && !iov->iov_len)) {
int copy;
copy = min(bytes, iov->iov_len - base);