summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAl Viro <viro@ZenIV.linux.org.uk>2016-10-11 18:21:14 +0100
committerLinus Torvalds <torvalds@linux-foundation.org>2016-10-11 10:40:01 -0700
commit1689c73a739d094b544c680b0dfdebe52ffee8fb (patch)
tree5a45d8a901398a27c3142e962a97865304e74f16
parent6b5e09a748ad0a0b198d0e268c7e689044bfe48a (diff)
downloadlinux-1689c73a739d094b544c680b0dfdebe52ffee8fb.tar.gz
linux-1689c73a739d094b544c680b0dfdebe52ffee8fb.tar.bz2
linux-1689c73a739d094b544c680b0dfdebe52ffee8fb.zip
Fix off-by-one in __pipe_get_pages()
it actually worked only when requested area ended on the page boundary... Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--lib/iov_iter.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 0ce341125195..7312e7784611 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -833,13 +833,13 @@ static inline size_t __pipe_get_pages(struct iov_iter *i,
size_t *start)
{
struct pipe_inode_info *pipe = i->pipe;
- size_t n = push_pipe(i, maxsize, &idx, start);
+ ssize_t n = push_pipe(i, maxsize, &idx, start);
if (!n)
return -EFAULT;
maxsize = n;
n += *start;
- while (n >= PAGE_SIZE) {
+ while (n > 0) {
get_page(*pages++ = pipe->bufs[idx].page);
idx = next_idx(idx, pipe);
n -= PAGE_SIZE;