Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 80d7f07f authored by Max Kellermann's avatar Max Kellermann Committed by Karsten Tausche
Browse files

lib/iov_iter: initialize "flags" in new pipe_buffer 



commit 9d2231c5d74e13b2a0546fee6737ee4446017903 upstream.

The functions copy_page_to_iter_pipe() and push_pipe() can both
allocate a new pipe_buffer, but the "flags" member initializer is
missing.

Fixes: 241699cd ("new iov_iter flavour: pipe-backed")
To: Alexander Viro <viro@zeniv.linux.org.uk>
To: linux-fsdevel@vger.kernel.org
To: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMax Kellermann <max.kellermann@ionos.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 220741611
Change-Id: I91076a0b6327ee8dd87e75fc875062b6adf2de4c
Issue: FP3SEC-335
(cherry picked from commit c460ef6e)
parent 6f98acf8

lib/iov_iter.c

+2 −0
Original line number Diff line number Diff line
@@ -370,6 +370,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by 
		return 0;

	pipe->nrbufs++;

	buf->ops = &page_cache_pipe_buf_ops;

	buf->flags = 0;

	get_page(buf->page = page);

	buf->offset = offset;

	buf->len = bytes;
@@ -494,6 +495,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size, 
			break;

		pipe->nrbufs++;

		pipe->bufs[idx].ops = &default_pipe_buf_ops;

		pipe->bufs[idx].flags = 0;

		pipe->bufs[idx].page = page;

		pipe->bufs[idx].offset = 0;

		if (left <= PAGE_SIZE) {