Jeff Layton <jlayton@xxxxxxxxxx> wrote: > + len = iinfo->inline_len; > + iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, subreq->start, len); > + err = copy_to_iter(iinfo->inline_data, len, &iter); I think this is probably wrong. It will read the entirety of the inline data into the buffer, even if it's bigger than the buffer and you need to offset pointer into the buffer. You need to limit it to subreq->len. Maybe: len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len); iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, subreq->start, len); err = copy_to_iter(iinfo->inline_data + subreq->start, len, &iter); David
