From: Al Viro viro@zeniv.linux.org.uk
[ Upstream commit 3b3fc051cd2cba42bf736fa62780857d251a1236 ]
asking to advance by more than we have left in the iov_iter should move to the very end; it should *not* leave negative i->count and it should not spew into syslog, etc. - it's a legitimate operation.
Signed-off-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Sasha Levin sashal@kernel.org --- lib/iov_iter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 9eb7c31688cc..459c33c26bea 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -1117,8 +1117,6 @@ static inline void pipe_truncate(struct iov_iter *i) static void pipe_advance(struct iov_iter *i, size_t size) { struct pipe_inode_info *pipe = i->pipe; - if (unlikely(i->count < size)) - size = i->count; if (size) { struct pipe_buffer *buf; unsigned int p_mask = pipe->ring_size - 1; @@ -1159,6 +1157,8 @@ static void iov_iter_bvec_advance(struct iov_iter *i, size_t size)
void iov_iter_advance(struct iov_iter *i, size_t size) { + if (unlikely(i->count < size)) + size = i->count; if (unlikely(iov_iter_is_pipe(i))) { pipe_advance(i, size); return; @@ -1168,7 +1168,6 @@ void iov_iter_advance(struct iov_iter *i, size_t size) return; } if (unlikely(iov_iter_is_xarray(i))) { - size = min(size, i->count); i->iov_offset += size; i->count -= size; return;