On Fri, 2022-01-21 at 14:57 +0000, David Howells wrote: > Jeff Layton <jlayton@xxxxxxxxxx> wrote: > > > + len = iinfo->inline_len; > > + iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, subreq->start, len); > > + err = copy_to_iter(iinfo->inline_data, len, &iter); > > I think this is probably wrong. It will read the entirety of the inline data > into the buffer, even if it's bigger than the buffer and you need to offset > pointer into the buffer. > > You need to limit it to subreq->len. Maybe: > > len = min_t(size_t, iinfo->inline_len - subreq->start, subreq->len); > iov_iter_xarray(&iter, READ, &rreq->mapping->i_pages, > subreq->start, len); > err = copy_to_iter(iinfo->inline_data + subreq->start, len, &iter); > > David > Good point. I'll make that change and re-test, but it makes sense. -- Jeff Layton <jlayton@xxxxxxxxxx>
