summaryrefslogtreecommitdiff
path: root/lib/iov_iter.c
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2017-05-08 13:54:47 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2017-05-08 13:54:47 -0400
commit5b47d59af68a8735e4637bacedcb4baf6f47c73f (patch)
treeca26a750a251a2d70c9c3f1616aa58f0c1c3c46d /lib/iov_iter.c
parenta6a5993243550b09f620941dea741b7421fdf79c (diff)
downloadlwn-5b47d59af68a8735e4637bacedcb4baf6f47c73f.tar.gz
lwn-5b47d59af68a8735e4637bacedcb4baf6f47c73f.zip
fix braino in generic_file_read_iter()
Wrong sign of iov_iter_revert() argument. Unfortunately, slipped through the testing, since most of the time we don't do anything to the iterator afterwards and potential oops on walking the iter->iov too far backwards is too infrequent to be easily triggered. Add a sanity check in iov_iter_revert() to catch bugs like this one; fortunately, the same braino hadn't happened in other callers, but we'd better have a warning if such thing crops up. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'lib/iov_iter.c')
-rw-r--r--lib/iov_iter.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 60abc44385b7..fc9fb29d00eb 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -790,6 +790,8 @@ void iov_iter_revert(struct iov_iter *i, size_t unroll)
{
if (!unroll)
return;
+ if (WARN_ON(unroll > MAX_RW_COUNT))
+ return;
i->count += unroll;
if (unlikely(i->type & ITER_PIPE)) {
struct pipe_inode_info *pipe = i->pipe;