summaryrefslogtreecommitdiffstats
path: root/include/asm-ia64/poll.h
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2008-07-30 23:45:12 +0200
committerLinus Torvalds <torvalds@linux-foundation.org>2008-07-30 23:50:18 +0200
commit94ad374a0751f40d25e22e036c37f7263569d24c (patch)
treed1bbf5d64c4eaee7bfefae22ad87b96967187cc8 /include/asm-ia64/poll.h
parentromfs_readpage: don't report errors for pages beyond i_size (diff)
downloadlinux-94ad374a0751f40d25e22e036c37f7263569d24c.tar.xz
linux-94ad374a0751f40d25e22e036c37f7263569d24c.zip
Fix off-by-one error in iov_iter_advance()
The iov_iter_advance() function would look at the iov->iov_len entry even though it might have iterated over the whole array, and iov was pointing past the end. This would cause DEBUG_PAGEALLOC to trigger a kernel page fault if the allocation was at the end of a page, and the next page was unallocated. The quick fix is to just change the order of the tests: check that there is any iovec data left before we check the iov entry itself. Thanks to Alexey Dobriyan for finding this case, and testing the fix. Reported-and-tested-by: Alexey Dobriyan <adobriyan@gmail.com> Cc: Nick Piggin <npiggin@suse.de> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/asm-ia64/poll.h')
0 files changed, 0 insertions, 0 deletions