[PATCH AUTOSEL 5.18 55/93] iov_iter_get_pages{,_alloc}(): cap the maxsize with MAX_RW_COUNT

From: Sasha Levin
Date: Thu Aug 11 2022 - 12:03:00 EST


From: Al Viro <viro@xxxxxxxxxxxxxxxxxx>

[ Upstream commit 7392ed1734c319150b5ddec3f192a6405728e8d0 ]

All callers can and should handle iov_iter_get_pages() returning
fewer pages than requested. All in-kernel ones do. And it makes
the arithmetical overflow analysis much simpler...

Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
lib/iov_iter.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 0b64695ab632..ea588628828b 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1520,6 +1520,8 @@ ssize_t iov_iter_get_pages(struct iov_iter *i,
maxsize = i->count;
if (!maxsize)
return 0;
+ if (maxsize > MAX_RW_COUNT)
+ maxsize = MAX_RW_COUNT;

if (likely(iter_is_iovec(i))) {
unsigned int gup_flags = 0;
@@ -1640,6 +1642,8 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
maxsize = i->count;
if (!maxsize)
return 0;
+ if (maxsize > MAX_RW_COUNT)
+ maxsize = MAX_RW_COUNT;

if (likely(iter_is_iovec(i))) {
unsigned int gup_flags = 0;
--
2.35.1