aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/relay.c
diff options
context:
space:
mode:
authorJens Axboe <jens.axboe@oracle.com>2008-03-17 04:04:59 -0400
committerJens Axboe <jens.axboe@oracle.com>2008-03-17 04:04:59 -0400
commit16d54669427069ef2823752c365d695b0cc4748f (patch)
treeab971bc703f790b90697d29a1e65a793b7f87628 /kernel/relay.c
parent2af3e6017e53065ddf40bb19190a29199b7ffee3 (diff)
relay: fix subbuf_splice_actor() adding too many pages
If subbuf_pages was larger than the max number of pages the pipe buffer will hold, subbuf_splice_actor() would happily go beyond the array size. Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Diffstat (limited to 'kernel/relay.c')
-rw-r--r--kernel/relay.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/kernel/relay.c b/kernel/relay.c
index d080b9d161a7..4c035a8a248c 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1066,7 +1066,7 @@ static int subbuf_splice_actor(struct file *in,
1066 unsigned int flags, 1066 unsigned int flags,
1067 int *nonpad_ret) 1067 int *nonpad_ret)
1068{ 1068{
1069 unsigned int pidx, poff, total_len, subbuf_pages, ret; 1069 unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
1070 struct rchan_buf *rbuf = in->private_data; 1070 struct rchan_buf *rbuf = in->private_data;
1071 unsigned int subbuf_size = rbuf->chan->subbuf_size; 1071 unsigned int subbuf_size = rbuf->chan->subbuf_size;
1072 uint64_t pos = (uint64_t) *ppos; 1072 uint64_t pos = (uint64_t) *ppos;
@@ -1097,8 +1097,9 @@ static int subbuf_splice_actor(struct file *in,
1097 subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT; 1097 subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
1098 pidx = (read_start / PAGE_SIZE) % subbuf_pages; 1098 pidx = (read_start / PAGE_SIZE) % subbuf_pages;
1099 poff = read_start & ~PAGE_MASK; 1099 poff = read_start & ~PAGE_MASK;
1100 nr_pages = min_t(unsigned int, subbuf_pages, PIPE_BUFFERS);
1100 1101
1101 for (total_len = 0; spd.nr_pages < subbuf_pages; spd.nr_pages++) { 1102 for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
1102 unsigned int this_len, this_end, private; 1103 unsigned int this_len, this_end, private;
1103 unsigned int cur_pos = read_start + total_len; 1104 unsigned int cur_pos = read_start + total_len;
1104 1105