| Message ID | 1b09a159-bcec-63c9-df42-47d99f44d445@virtuozzo.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fuse: BUG_ON correction in fuse_dev_splice_write() | expand |
On Mon, Aug 19, 2019 at 8:53 AM Vasily Averin <vvs@virtuozzo.com> wrote: > > commit 963545357202 ("fuse: reduce allocation size for splice_write") > changed size of bufs array, so BUG_ON which checks the index of the array > shold also be fixed. > > Fixes: 963545357202 ("fuse: reduce allocation size for splice_write") > Signed-off-by: Vasily Averin <vvs@virtuozzo.com> > --- > fs/fuse/dev.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c > index ea8237513dfa..f4ef6e01642c 100644 > --- a/fs/fuse/dev.c > +++ b/fs/fuse/dev.c > @@ -2029,7 +2029,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, > struct file *out, loff_t *ppos, > size_t len, unsigned int flags) > { > - unsigned nbuf; > + unsigned nbuf, bsize; > unsigned idx; > struct pipe_buffer *bufs; > struct fuse_copy_state cs; > @@ -2043,7 +2043,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, > > pipe_lock(pipe); > > - bufs = kvmalloc_array(pipe->nrbufs, sizeof(struct pipe_buffer), > + bsize = pipe->nrbufs; > + bufs = kvmalloc_array(bsize, sizeof(struct pipe_buffer), > GFP_KERNEL); > if (!bufs) { > pipe_unlock(pipe); > @@ -2064,7 +2065,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, > struct pipe_buffer *ibuf; > struct pipe_buffer *obuf; > > - BUG_ON(nbuf >= pipe->buffers); > + BUG_ON(nbuf >= bsize); > BUG_ON(!pipe->nrbufs); Better turn these into WARN_ON's.. Fixed and applied. Thanks, Miklos
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index ea8237513dfa..f4ef6e01642c 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -2029,7 +2029,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, struct file *out, loff_t *ppos, size_t len, unsigned int flags) { - unsigned nbuf; + unsigned nbuf, bsize; unsigned idx; struct pipe_buffer *bufs; struct fuse_copy_state cs; @@ -2043,7 +2043,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, pipe_lock(pipe); - bufs = kvmalloc_array(pipe->nrbufs, sizeof(struct pipe_buffer), + bsize = pipe->nrbufs; + bufs = kvmalloc_array(bsize, sizeof(struct pipe_buffer), GFP_KERNEL); if (!bufs) { pipe_unlock(pipe); @@ -2064,7 +2065,7 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, struct pipe_buffer *ibuf; struct pipe_buffer *obuf; - BUG_ON(nbuf >= pipe->buffers); + BUG_ON(nbuf >= bsize); BUG_ON(!pipe->nrbufs); ibuf = &pipe->bufs[pipe->curbuf]; obuf = &bufs[nbuf];
commit 963545357202 ("fuse: reduce allocation size for splice_write") changed size of bufs array, so BUG_ON which checks the index of the array shold also be fixed. Fixes: 963545357202 ("fuse: reduce allocation size for splice_write") Signed-off-by: Vasily Averin <vvs@virtuozzo.com> --- fs/fuse/dev.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)