Commit b0cfbd99 authored Jun 25, 2005 by Badari Pulavarty Committed by Linus Torvalds Jun 25, 2005

[PATCH] fix for generic_file_write iov problem

Here is the fix for the problem described in

	http://bugzilla.kernel.org/show_bug.cgi?id=4721



Basically, problem is generic_file_buffered_write() is accessing beyond end
of the iov[] vector after handling the last vector.  If we happen to cross
page boundary, we get a fault.

I think this simple patch is good enough.  If we really don't want to
depend on the "count", then we need pass nr_segs to
filemap_set_next_iovec() and decrement it and check it.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

parent 8ae0b778

mm/filemap.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -1954,7 +1954,9 @@ generic_file_buffered_write(struct kiocb iocb, const struct iovec iov,
		if (unlikely(nr_segs > 1)) {
		filemap_set_next_iovec(&cur_iov,
		&iov_base, status);
		buf = cur_iov->iov_base + iov_base;
		if (count)
		buf = cur_iov->iov_base +
		iov_base;
		} else {
		iov_base += status;
		}

Admin message