Messages in this thread Patch in this message | | | Subject | [PATCH] fix for generic_file_write iov problem | From | Badari Pulavarty <> | Date | 17 Jun 2005 15:09:18 -0700 |
| |
Hi Andrew,
Here is the fix for the problem described in
http://bugzilla.kernel.org/show_bug.cgi?id=4721
Basically, problem is generic_file_buffered_write() is accessing beyond end of the iov[] vector after handling the last vector. If we happen to cross page boundary, we get a fault.
I think this simple patch is good enough. If we really don't want to depend on the "count", then we need pass nr_segs to filemap_set_next_iovec() and decrement it and check it.
What do you think ?
Thanks, Badari
--- linux-2.6.12-rc6.org/mm/filemap.c 2005-06-17 15:10:05.000000000 -0700 +++ linux-2.6.12-rc6/mm/filemap.c 2005-06-17 15:10:29.000000000 -0700 @@ -2023,7 +2023,8 @@ generic_file_buffered_write(struct kiocb if (unlikely(nr_segs > 1)) { filemap_set_next_iovec(&cur_iov, &iov_base, status); - buf = cur_iov->iov_base + iov_base; + if (count) + buf = cur_iov->iov_base + iov_base; } } } | |