kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix off-by-one in __pipe_get_pages()

Browse source 
it actually worked only when requested area ended on the page boundary...

Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Al Viro 2016-10-11 18:21:14 +01:00 committed by Linus Torvalds
parent 6b5e09a748
commit 1689c73a73
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/iov_iter.c
View file

@ -833,13 +833,13 @@ static inline size_t __pipe_get_pages(struct iov_iter *i,
size_t *start)
{
struct pipe_inode_info *pipe = i->pipe;
size_t n = push_pipe(i, maxsize, &idx, start);
ssize_t n = push_pipe(i, maxsize, &idx, start);
if (!n)
return -EFAULT;
maxsize = n;
n += *start;
while (n >= PAGE_SIZE) {
while (n > 0) {
get_page(*pages++ = pipe->bufs[idx].page);
idx = next_idx(idx, pipe);
n -= PAGE_SIZE;