Fix off-by-one error in iov_iter_advance()

The iov_iter_advance() function would look at the iov->iov_len entry

even though it might have iterated over the whole array, and iov was

pointing past the end. This would cause DEBUG_PAGEALLOC to trigger a

kernel page fault if the allocation was at the end of a page, and the

next page was unallocated.

The quick fix is to just change the order of the tests: check that there

is any iovec data left before we check the iov entry itself.

Thanks to Alexey Dobriyan for finding this case, and testing the fix.

Reported-and-tested-by: Alexey Dobriyan

Cc: Nick Piggin

Cc: Andrew Morton

Cc: [2.6.25.x, 2.6.26.x]

Signed-off-by: Linus Torvalds

1 files changed

diff --git a/mm/filemap.c b/mm/filemap.c

index 42bbc69..d97d1ad 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1879,7 +1879,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
 		 * The !iov->iov_len check ensures we skip over unlikely
 		 * zero-length segments (without overruning the iovec).
 		 */
-		while (bytes || unlikely(!iov->iov_len && i->count)) {
+		while (bytes || unlikely(i->count && !iov->iov_len)) {
 			int copy;
 
 			copy = min(bytes, iov->iov_len - base);