diff options
| author | Petar Penkov <ppenkov@google.com> | 2017-08-29 20:20:32 +0200 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2017-09-21 05:27:48 +0200 |
| commit | a90bcb86ae700c12432446c4aa1819e7b8e172ec (patch) | |
| tree | f172eb5b81e958457422d74e66587bf0071ddebe /lib | |
| parent | Linux 4.14-rc1 (diff) | |
| download | linux-a90bcb86ae700c12432446c4aa1819e7b8e172ec.tar.xz linux-a90bcb86ae700c12432446c4aa1819e7b8e172ec.zip | |
iov_iter: fix page_copy_sane for compound pages
Issue is that if the data crosses a page boundary inside a compound
page, this check will incorrectly trigger a WARN_ON.
To fix this, compute the order using the head of the compound page and
adjust the offset to be relative to that head.
Fixes: 72e809ed81ed ("iov_iter: sanity checks for copy to/from page
primitives")
Signed-off-by: Petar Penkov <ppenkov@google.com>
CC: Al Viro <viro@zeniv.linux.org.uk>
CC: Eric Dumazet <edumazet@google.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/iov_iter.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 52c8dd6d8e82..1c1c06ddc20a 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache); static inline bool page_copy_sane(struct page *page, size_t offset, size_t n) { - size_t v = n + offset; - if (likely(n <= v && v <= (PAGE_SIZE << compound_order(page)))) + struct page *head = compound_head(page); + size_t v = n + offset + page_address(page) - page_address(head); + + if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head)))) return true; WARN_ON(1); return false; |