mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
Fix off-by-one in __pipe_get_pages()
it actually worked only when requested area ended on the page boundary... Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
6b5e09a748
commit
1689c73a73
1 changed files with 2 additions and 2 deletions
|
@ -833,13 +833,13 @@ static inline size_t __pipe_get_pages(struct iov_iter *i,
|
||||||
size_t *start)
|
size_t *start)
|
||||||
{
|
{
|
||||||
struct pipe_inode_info *pipe = i->pipe;
|
struct pipe_inode_info *pipe = i->pipe;
|
||||||
size_t n = push_pipe(i, maxsize, &idx, start);
|
ssize_t n = push_pipe(i, maxsize, &idx, start);
|
||||||
if (!n)
|
if (!n)
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
|
||||||
maxsize = n;
|
maxsize = n;
|
||||||
n += *start;
|
n += *start;
|
||||||
while (n >= PAGE_SIZE) {
|
while (n > 0) {
|
||||||
get_page(*pages++ = pipe->bufs[idx].page);
|
get_page(*pages++ = pipe->bufs[idx].page);
|
||||||
idx = next_idx(idx, pipe);
|
idx = next_idx(idx, pipe);
|
||||||
n -= PAGE_SIZE;
|
n -= PAGE_SIZE;
|
||||||
|
|
Loading…
Reference in a new issue