1 files changed, 10 insertions, 12 deletions

diff --git a/mm/filemap.c b/mm/filemap.c
index ab98557e228e..df343d1e6345 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1742,21 +1742,27 @@ size_t iov_iter_copy_from_user(struct page *page,
 }
 EXPORT_SYMBOL(iov_iter_copy_from_user);
 
-static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
+void iov_iter_advance(struct iov_iter *i, size_t bytes)
 {
+        BUG_ON(i->count < bytes);
+
         if (likely(i->nr_segs == 1)) {
                 i->iov_offset += bytes;
+                i->count -= bytes;
         } else {
                 const struct iovec *iov = i->iov;
                 size_t base = i->iov_offset;
 
                 /*
                  * The !iov->iov_len check ensures we skip over unlikely
-                 * zero-length segments.
+                 * zero-length segments (without overruning the iovec).
                  */
-                while (bytes || !iov->iov_len) {
-                        int copy = min(bytes, iov->iov_len - base);
+                while (bytes || unlikely(!iov->iov_len && i->count)) {
+                        int copy;
 
+                        copy = min(bytes, iov->iov_len - base);
+                        BUG_ON(!i->count || i->count < copy);
+                        i->count -= copy;
                         bytes -= copy;
                         base += copy;
                         if (iov->iov_len == base) {
@@ -1768,14 +1774,6 @@ static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes)
                 i->iov_offset = base;
         }
 }
-
-void iov_iter_advance(struct iov_iter *i, size_t bytes)
-{
-        BUG_ON(i->count < bytes);
-
-        __iov_iter_advance_iov(i, bytes);
-        i->count -= bytes;
-}
 EXPORT_SYMBOL(iov_iter_advance);
 
 /*