From: Olga Kornievskaia <kolga@xxxxxxxxxx>
Input source offset can't be beyond the end of the file.
Signed-off-by: Olga Kornievskaia <kolga@xxxxxxxxxx>
---
fs/read_write.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/read_write.c b/fs/read_write.c
index fb4ffca..72b2c74 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1594,6 +1594,9 @@ ssize_t vfs_copy_file_range(struct file *file_in, loff_t pos_in,
}
}
+ if (pos_in > i_size_read(inode_in))
+ return -EINVAL;
+
if (file_out->f_op->copy_file_range) {
ret = file_out->f_op->copy_file_range(file_in, pos_in, file_out,
pos_out, len, flags);
--
1.8.3.1
