iov_iter_advance() fix

[linux-2.6-omap-h63xx.git] / mm / filemap.c

diff --git a/mm/filemap.c b/mm/filemap.c
index ab98557e228e857407a10396db56c6835a30401e..df343d1e6345ffb33ef3fa4eacf6c784c0ef8178 100644 (file)
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1742,21 +1742,27 @@ size_t iov_iter_copy_from_user(struct page *page,
 }
 EXPORT_SYMBOL(iov_iter_copy_from_user);
 
-static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
+void iov_iter_advance(struct iov_iter *i, size_t bytes)
 {
+       BUG_ON(i->count < bytes);
+
        if (likely(i->nr_segs == 1)) {
                i->iov_offset += bytes;
+               i->count -= bytes;
        } else {
                const struct iovec *iov = i->iov;
                size_t base = i->iov_offset;
 
                /*
                 * The !iov->iov_len check ensures we skip over unlikely
-                * zero-length segments.
+                * zero-length segments (without overruning the iovec).
                 */
-               while (bytes || !iov->iov_len) {
-                       int copy = min(bytes, iov->iov_len - base);
+               while (bytes || unlikely(!iov->iov_len && i->count)) {
+                       int copy;
 
+                       copy = min(bytes, iov->iov_len - base);
+                       BUG_ON(!i->count || i->count < copy);
+                       i->count -= copy;
                        bytes -= copy;
                        base += copy;
                        if (iov->iov_len == base) {
@@ -1768,14 +1774,6 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
                i->iov_offset = base;
        }
 }
-
-void iov_iter_advance(struct iov_iter *i, size_t bytes)
-{
-       BUG_ON(i->count < bytes);
-
-       __iov_iter_advance_iov(i, bytes);
-       i->count -= bytes;
-}
 EXPORT_SYMBOL(iov_iter_advance);
 
 /*