On Wed, Apr 06, 2022 at 07:09:22PM +0100, Catalin Marinas wrote:
> diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
> index 238cee5b5254..d49e8254f823 100644
> --- a/fs/btrfs/ioctl.c
> +++ b/fs/btrfs/ioctl.c
> @@ -2556,8 +2556,13 @@ static noinline int search_ioctl(struct inode *inode,
> key.offset = sk->min_offset;
>
> while (1) {
> + size_t len = *buf_size - sk_offset;
> ret = -EFAULT;
> - if (fault_in_writeable(ubuf + sk_offset, *buf_size - sk_offset))
> + /*
> + * Ensure that the whole user buffer is faulted in at sub-page
> + * granularity, otherwise the loop may live-lock.
> + */
> + if (fault_in_subpage_writeable(ubuf + sk_offset, len))
> break;
This doesn't need a new 'len' variable. It's a left-over from the v2
where fault_in_writeable() took the size and a min_size argument, both
being 'len'.
--
Catalin
