diff options
| author |   Al Viro <viro@zeniv.linux.org.uk> | 2022-06-11 16:44:21 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2022-07-06 16:27:17 -0400 |
| commit | 7392ed1734c319150b5ddec3f192a6405728e8d0 (patch) | |
| tree | a611a08e4d20f75cb152b750ada69fedb4db2ac1 /lib/iov_iter.c | |
| parent | iov_iter_bvec_advance(): don't bother with bvec_iter (diff) | |
| download | linux-dev-7392ed1734c319150b5ddec3f192a6405728e8d0.tar.xz linux-dev-7392ed1734c319150b5ddec3f192a6405728e8d0.zip | |
iov_iter_get_pages{,_alloc}(): cap the maxsize with MAX_RW_COUNT
All callers can and should handle iov_iter_get_pages() returning
fewer pages than requested. All in-kernel ones do. And it makes
the arithmetical overflow analysis much simpler...
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'lib/iov_iter.c')
| -rw-r--r-- | lib/iov_iter.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/iov_iter.c b/lib/iov_iter.c index c51314639615..225b968ed8c5 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -1348,6 +1348,8 @@ ssize_t iov_iter_get_pages(struct iov_iter *i, maxsize = i->count; if (!maxsize) return 0; + if (maxsize > MAX_RW_COUNT) + maxsize = MAX_RW_COUNT; if (likely(iter_is_iovec(i))) { unsigned int gup_flags = 0; @@ -1474,6 +1476,8 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, maxsize = i->count; if (!maxsize) return 0; + if (maxsize > MAX_RW_COUNT) + maxsize = MAX_RW_COUNT; if (likely(iter_is_iovec(i))) { unsigned int gup_flags = 0; |