Commit c43aeb19 authored by Al Viro's avatar Al Viro

fix brown paperbag bug in inlined copy_..._iter()

"copied nothing" == "return 0", not "return full size".

Fixes: aa28de27 "iov_iter/hardening: move object size checks to inlined part"
Spotted-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent f263fbb8
...@@ -103,7 +103,7 @@ static __always_inline __must_check ...@@ -103,7 +103,7 @@ static __always_inline __must_check
size_t copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i) size_t copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
{ {
if (unlikely(!check_copy_size(addr, bytes, true))) if (unlikely(!check_copy_size(addr, bytes, true)))
return bytes; return 0;
else else
return _copy_to_iter(addr, bytes, i); return _copy_to_iter(addr, bytes, i);
} }
...@@ -112,7 +112,7 @@ static __always_inline __must_check ...@@ -112,7 +112,7 @@ static __always_inline __must_check
size_t copy_from_iter(void *addr, size_t bytes, struct iov_iter *i) size_t copy_from_iter(void *addr, size_t bytes, struct iov_iter *i)
{ {
if (unlikely(!check_copy_size(addr, bytes, false))) if (unlikely(!check_copy_size(addr, bytes, false)))
return bytes; return 0;
else else
return _copy_from_iter(addr, bytes, i); return _copy_from_iter(addr, bytes, i);
} }
...@@ -130,7 +130,7 @@ static __always_inline __must_check ...@@ -130,7 +130,7 @@ static __always_inline __must_check
size_t copy_from_iter_nocache(void *addr, size_t bytes, struct iov_iter *i) size_t copy_from_iter_nocache(void *addr, size_t bytes, struct iov_iter *i)
{ {
if (unlikely(!check_copy_size(addr, bytes, false))) if (unlikely(!check_copy_size(addr, bytes, false)))
return bytes; return 0;
else else
return _copy_from_iter_nocache(addr, bytes, i); return _copy_from_iter_nocache(addr, bytes, i);
} }
...@@ -160,7 +160,7 @@ static __always_inline __must_check ...@@ -160,7 +160,7 @@ static __always_inline __must_check
size_t copy_from_iter_flushcache(void *addr, size_t bytes, struct iov_iter *i) size_t copy_from_iter_flushcache(void *addr, size_t bytes, struct iov_iter *i)
{ {
if (unlikely(!check_copy_size(addr, bytes, false))) if (unlikely(!check_copy_size(addr, bytes, false)))
return bytes; return 0;
else else
return _copy_from_iter_flushcache(addr, bytes, i); return _copy_from_iter_flushcache(addr, bytes, i);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment