Commit b0cfbd99 authored by Badari Pulavarty's avatar Badari Pulavarty Committed by Linus Torvalds

[PATCH] fix for generic_file_write iov problem

Here is the fix for the problem described in

	http://bugzilla.kernel.org/show_bug.cgi?id=4721

Basically, problem is generic_file_buffered_write() is accessing beyond end
of the iov[] vector after handling the last vector.  If we happen to cross
page boundary, we get a fault.

I think this simple patch is good enough.  If we really don't want to
depend on the "count", then we need pass nr_segs to
filemap_set_next_iovec() and decrement it and check it.
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 8ae0b778
...@@ -1954,7 +1954,9 @@ generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov, ...@@ -1954,7 +1954,9 @@ generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
if (unlikely(nr_segs > 1)) { if (unlikely(nr_segs > 1)) {
filemap_set_next_iovec(&cur_iov, filemap_set_next_iovec(&cur_iov,
&iov_base, status); &iov_base, status);
buf = cur_iov->iov_base + iov_base; if (count)
buf = cur_iov->iov_base +
iov_base;
} else { } else {
iov_base += status; iov_base += status;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment