From: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
[ Upstream commit 3b3fc051cd2cba42bf736fa62780857d251a1236 ]
asking to advance by more than we have left in the iov_iter should
move to the very end; it should *not* leave negative i->count and
it should not spew into syslog, etc. - it's a legitimate operation.
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
lib/iov_iter.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index c701b7a187f2..82a889283eca 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1092,8 +1092,6 @@ static inline void pipe_truncate(struct iov_iter *i)
static void pipe_advance(struct iov_iter *i, size_t size)
{
struct pipe_inode_info *pipe = i->pipe;
- if (unlikely(i->count < size))
- size = i->count;
if (size) {
struct pipe_buffer *buf;
unsigned int p_mask = pipe->ring_size - 1;
@@ -1134,6 +1132,8 @@ static void iov_iter_bvec_advance(struct iov_iter *i, size_t size)
void iov_iter_advance(struct iov_iter *i, size_t size)
{
+ if (unlikely(i->count < size))
+ size = i->count;
if (unlikely(iov_iter_is_pipe(i))) {
pipe_advance(i, size);
return;
@@ -1143,7 +1143,6 @@ void iov_iter_advance(struct iov_iter *i, size_t size)
return;
}
if (unlikely(iov_iter_is_xarray(i))) {
- size = min(size, i->count);
i->iov_offset += size;
i->count -= size;
return;
--
2.30.2
