iov_iter_advance(): use consistent semantics for move past the end
authorAl Viro <viro@zeniv.linux.org.uk>
Sat, 24 Apr 2021 02:24:08 +0000 (22:24 -0400)
committerAl Viro <viro@zeniv.linux.org.uk>
Thu, 3 Jun 2021 14:36:52 +0000 (10:36 -0400)
asking to advance by more than we have left in the iov_iter should
move to the very end; it should *not* leave negative i->count and
it should not spew into syslog, etc. - it's a legitimate operation.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
lib/iov_iter.c

index a3aabeda945b7580b5d62634c1d0637bf7915d06..bdbe6691457d38363e2ee9eafa9d06e878a8a8c4 100644 (file)
@@ -1117,8 +1117,6 @@ static inline void pipe_truncate(struct iov_iter *i)
 static void pipe_advance(struct iov_iter *i, size_t size)
 {
        struct pipe_inode_info *pipe = i->pipe;
-       if (unlikely(i->count < size))
-               size = i->count;
        if (size) {
                struct pipe_buffer *buf;
                unsigned int p_mask = pipe->ring_size - 1;
@@ -1159,6 +1157,8 @@ static void iov_iter_bvec_advance(struct iov_iter *i, size_t size)
 
 void iov_iter_advance(struct iov_iter *i, size_t size)
 {
+       if (unlikely(i->count < size))
+               size = i->count;
        if (unlikely(iov_iter_is_pipe(i))) {
                pipe_advance(i, size);
                return;
@@ -1168,7 +1168,6 @@ void iov_iter_advance(struct iov_iter *i, size_t size)
                return;
        }
        if (unlikely(iov_iter_is_xarray(i))) {
-               size = min(size, i->count);
                i->iov_offset += size;
                i->count -= size;
                return;