Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs fix from Al Viro:
 "Braino fix for iov_iter_revert() misuse"

* 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fix braino in generic_file_read_iter()

2 files changed, 3 insertions, 1 deletions

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index ae82d9cea553..f835964c9485 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -790,6 +790,8 @@ void iov_iter_revert(struct iov_iter *i, size_t unroll)
 {
         if (!unroll)
                 return;
+        if (WARN_ON(unroll > MAX_RW_COUNT))
+                return;
         i->count += unroll;
         if (unlikely(i->type & ITER_PIPE)) {
                 struct pipe_inode_info *pipe = i->pipe;
diff --git a/mm/filemap.c b/mm/filemap.c
index b7b973b47d8d..6f1be573a5e6 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2050,7 +2050,7 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
                         iocb->ki_pos += retval;
                         count -= retval;
                 }
-                iov_iter_revert(iter, iov_iter_count(iter) - count);
+                iov_iter_revert(iter, count - iov_iter_count(iter));
 
                 /*
                  * Btrfs can have a short DIO read if we encounter