提交 1689c73a 编写于 作者: A Al Viro 提交者: Linus Torvalds

Fix off-by-one in __pipe_get_pages()

it actually worked only when requested area ended on the page boundary...
Reported-by: NMarco Grassi <marco.gra@gmail.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 6b5e09a7
......@@ -833,13 +833,13 @@ static inline size_t __pipe_get_pages(struct iov_iter *i,
size_t *start)
{
struct pipe_inode_info *pipe = i->pipe;
size_t n = push_pipe(i, maxsize, &idx, start);
ssize_t n = push_pipe(i, maxsize, &idx, start);
if (!n)
return -EFAULT;
maxsize = n;
n += *start;
while (n >= PAGE_SIZE) {
while (n > 0) {
get_page(*pages++ = pipe->bufs[idx].page);
idx = next_idx(idx, pipe);
n -= PAGE_SIZE;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册