adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2024-12-27 11:16:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix off-by-one error in iov_iter_advance()

Browse source 
The iov_iter_advance() function would look at the iov->iov_len entry
even though it might have iterated over the whole array, and iov was
pointing past the end.  This would cause DEBUG_PAGEALLOC to trigger a
kernel page fault if the allocation was at the end of a page, and the
next page was unallocated.

The quick fix is to just change the order of the tests: check that there
is any iovec data left before we check the iov entry itself.

Thanks to Alexey Dobriyan for finding this case, and testing the fix.

Reported-and-tested-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Nick Piggin <npiggin@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Linus Torvalds 2008-07-30 14:45:12 -07:00
parent 0056e65f9e
commit 94ad374a07
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
mm/filemap.c
View file

@ -1879,7 +1879,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
* The !iov->iov_len check ensures we skip over unlikely * The !iov->iov_len check ensures we skip over unlikely
* zero-length segments (without overruning the iovec). * zero-length segments (without overruning the iovec).
*/ */
while (bytes || unlikely(!iov->iov_len && i->count)) { while (bytes || unlikely(i->count && !iov->iov_len)) {
int copy; int copy;
copy = min(bytes, iov->iov_len - base); copy = min(bytes, iov->iov_len - base);