Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1689c73a authored by Al Viro's avatar Al Viro Committed by Linus Torvalds
Browse files

Fix off-by-one in __pipe_get_pages() 



it actually worked only when requested area ended on the page boundary...

Reported-by: default avatarMarco Grassi <marco.gra@gmail.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 6b5e09a7

lib/iov_iter.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -833,13 +833,13 @@ static inline size_t __pipe_get_pages(struct iov_iter *i, 
				size_t *start)

				size_t *start)

{

{

	struct pipe_inode_info *pipe = i->pipe;

	struct pipe_inode_info *pipe = i->pipe;

	size_t n = push_pipe(i, maxsize, &idx, start);

	ssize_t n = push_pipe(i, maxsize, &idx, start);

	if (!n)

	if (!n)

		return -EFAULT;

		return -EFAULT;





	maxsize = n;

	maxsize = n;

	n += *start;

	n += *start;

	while (n >= PAGE_SIZE) {

	while (n > 0) {

		get_page(*pages++ = pipe->bufs[idx].page);

		get_page(*pages++ = pipe->bufs[idx].page);

		idx = next_idx(idx, pipe);

		idx = next_idx(idx, pipe);

		n -= PAGE_SIZE;

		n -= PAGE_SIZE;