Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs fix from Al Viro:
 "Braino fix for iov_iter_revert() misuse"

* 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fix braino in generic_file_read_iter()

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index ae82d9cea5533647181cea7b6c3d005838bfc0f8..f835964c9485f147699609bf2c2dc1ffecb8833b 100644 (file)
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -790,6 +790,8 @@ void iov_iter_revert(struct iov_iter *i, size_t unroll)
 {
        if (!unroll)
                return;
+       if (WARN_ON(unroll > MAX_RW_COUNT))
+               return;
        i->count += unroll;
        if (unlikely(i->type & ITER_PIPE)) {
                struct pipe_inode_info *pipe = i->pipe;

diff --git a/mm/filemap.c b/mm/filemap.c
index b7b973b47d8d9c498d9cafc83bfa2a21ea33e757..6f1be573a5e60fbb0c4a6cbcf85df9b32b0fc673 100644 (file)
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2050,7 +2050,7 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
                        iocb->ki_pos += retval;
                        count -= retval;
                }
-               iov_iter_revert(iter, iov_iter_count(iter) - count);
+               iov_iter_revert(iter, count - iov_iter_count(iter));
 
                /*
                 * Btrfs can have a short DIO read if we encounter