diff options
| author | Al Viro <viro@ZenIV.linux.org.uk> | 2016-10-11 18:21:14 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2016-10-11 10:40:01 -0700 |
| commit | 1689c73a739d094b544c680b0dfdebe52ffee8fb (patch) | |
| tree | 5a45d8a901398a27c3142e962a97865304e74f16 | |
| parent | 6b5e09a748ad0a0b198d0e268c7e689044bfe48a (diff) | |
| download | linux-1689c73a739d094b544c680b0dfdebe52ffee8fb.tar.gz linux-1689c73a739d094b544c680b0dfdebe52ffee8fb.tar.bz2 linux-1689c73a739d094b544c680b0dfdebe52ffee8fb.zip | |
Fix off-by-one in __pipe_get_pages()
it actually worked only when requested area ended on the page boundary...
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | lib/iov_iter.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 0ce341125195..7312e7784611 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -833,13 +833,13 @@ static inline size_t __pipe_get_pages(struct iov_iter *i, size_t *start) { struct pipe_inode_info *pipe = i->pipe; - size_t n = push_pipe(i, maxsize, &idx, start); + ssize_t n = push_pipe(i, maxsize, &idx, start); if (!n) return -EFAULT; maxsize = n; n += *start; - while (n >= PAGE_SIZE) { + while (n > 0) { get_page(*pages++ = pipe->bufs[idx].page); idx = next_idx(idx, pipe); n -= PAGE_SIZE; |