diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2008-07-30 14:45:12 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-07-30 14:50:18 -0700 |
commit | 94ad374a0751f40d25e22e036c37f7263569d24c (patch) | |
tree | d1bbf5d64c4eaee7bfefae22ad87b96967187cc8 /include/asm-ia64 | |
parent | 0056e65f9e28d83ee1a3fb4f7d0041e838f03c34 (diff) | |
download | kernel_samsung_smdk4412-94ad374a0751f40d25e22e036c37f7263569d24c.zip kernel_samsung_smdk4412-94ad374a0751f40d25e22e036c37f7263569d24c.tar.gz kernel_samsung_smdk4412-94ad374a0751f40d25e22e036c37f7263569d24c.tar.bz2 |
Fix off-by-one error in iov_iter_advance()
The iov_iter_advance() function would look at the iov->iov_len entry
even though it might have iterated over the whole array, and iov was
pointing past the end. This would cause DEBUG_PAGEALLOC to trigger a
kernel page fault if the allocation was at the end of a page, and the
next page was unallocated.
The quick fix is to just change the order of the tests: check that there
is any iovec data left before we check the iov entry itself.
Thanks to Alexey Dobriyan for finding this case, and testing the fix.
Reported-and-tested-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Nick Piggin <npiggin@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/asm-ia64')
0 files changed, 0 insertions, 0 deletions