diff options
| author | Chunwei Chen <[email protected]> | 2015-09-29 00:02:31 -0700 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2015-09-29 10:06:58 -0700 |
| commit | 45838e3a414a7a1a5fb49dc528dee1d22449599b (patch) | |
| tree | e90de972b6d8203693e6c64145408c993e7bf1c5 /module | |
| parent | b815ec32b3ba04ad7307ca8945a865eec0ec766b (diff) | |
Fix uioskip crash when skip to end
When doing uioskip to skip an iovec to the very end, the current loop
condition will falsely check pass the end of iovec. We fix this checking
uio_iovcnt first.
Signed-off-by: Chunwei Chen <[email protected]>
Signed-off-by: Brian Behlendorf <[email protected]>
Closes #3806
Closes #3850
Diffstat (limited to 'module')
| -rw-r--r-- | module/zcommon/zfs_uio.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/module/zcommon/zfs_uio.c b/module/zcommon/zfs_uio.c index 6037fed80..f78db68e4 100644 --- a/module/zcommon/zfs_uio.c +++ b/module/zcommon/zfs_uio.c @@ -236,13 +236,15 @@ uioskip(uio_t *uiop, size_t n) uiop->uio_skip += n; if (uiop->uio_segflg != UIO_BVEC) { - while (uiop->uio_skip >= uiop->uio_iov->iov_len) { + while (uiop->uio_iovcnt && + uiop->uio_skip >= uiop->uio_iov->iov_len) { uiop->uio_skip -= uiop->uio_iov->iov_len; uiop->uio_iov++; uiop->uio_iovcnt--; } } else { - while (uiop->uio_skip >= uiop->uio_bvec->bv_len) { + while (uiop->uio_iovcnt && + uiop->uio_skip >= uiop->uio_bvec->bv_len) { uiop->uio_skip -= uiop->uio_bvec->bv_len; uiop->uio_bvec++; uiop->uio_iovcnt--; |