Patch "iov_iter_advance(): use consistent semantics for move past the end" has been added to the 5.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    iov_iter_advance(): use consistent semantics for move past the end

to the 5.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     iov_iter_advance-use-consistent-semantics-for-move-p.patch
and it can be found in the queue-5.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1f09ac2f6cb9652d2c7d249939a416b71277e317
Author: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Date:   Fri Apr 23 22:24:08 2021 -0400

    iov_iter_advance(): use consistent semantics for move past the end
    
    [ Upstream commit 3b3fc051cd2cba42bf736fa62780857d251a1236 ]
    
    asking to advance by more than we have left in the iov_iter should
    move to the very end; it should *not* leave negative i->count and
    it should not spew into syslog, etc. - it's a legitimate operation.
    
    Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 9eb7c31688cc..459c33c26bea 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1117,8 +1117,6 @@ static inline void pipe_truncate(struct iov_iter *i)
 static void pipe_advance(struct iov_iter *i, size_t size)
 {
 	struct pipe_inode_info *pipe = i->pipe;
-	if (unlikely(i->count < size))
-		size = i->count;
 	if (size) {
 		struct pipe_buffer *buf;
 		unsigned int p_mask = pipe->ring_size - 1;
@@ -1159,6 +1157,8 @@ static void iov_iter_bvec_advance(struct iov_iter *i, size_t size)
 
 void iov_iter_advance(struct iov_iter *i, size_t size)
 {
+	if (unlikely(i->count < size))
+		size = i->count;
 	if (unlikely(iov_iter_is_pipe(i))) {
 		pipe_advance(i, size);
 		return;
@@ -1168,7 +1168,6 @@ void iov_iter_advance(struct iov_iter *i, size_t size)
 		return;
 	}
 	if (unlikely(iov_iter_is_xarray(i))) {
-		size = min(size, i->count);
 		i->iov_offset += size;
 		i->count -= size;
 		return;