From 5b47d59af68a8735e4637bacedcb4baf6f47c73f Mon Sep 17 00:00:00 2001 From: Al Viro Date: Mon, 8 May 2017 13:54:47 -0400 Subject: fix braino in generic_file_read_iter() Wrong sign of iov_iter_revert() argument. Unfortunately, slipped through the testing, since most of the time we don't do anything to the iterator afterwards and potential oops on walking the iter->iov too far backwards is too infrequent to be easily triggered. Add a sanity check in iov_iter_revert() to catch bugs like this one; fortunately, the same braino hadn't happened in other callers, but we'd better have a warning if such thing crops up. Signed-off-by: Al Viro --- lib/iov_iter.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lib') diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 60abc44385b7..fc9fb29d00eb 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -790,6 +790,8 @@ void iov_iter_revert(struct iov_iter *i, size_t unroll) { if (!unroll) return; + if (WARN_ON(unroll > MAX_RW_COUNT)) + return; i->count += unroll; if (unlikely(i->type & ITER_PIPE)) { struct pipe_inode_info *pipe = i->pipe; -- cgit v1.2.3-59-g8ed1b