View | Details | Raw Unified | Return to bug 65318
Collapse All | Expand All

(-)a/fs/read_write.c (-3 / +10 lines)
Lines 186-199 Link Here
186
int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count)
186
int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count)
187
{
187
{
188
	struct inode *inode;
188
	struct inode *inode;
189
	loff_t pos;
189
190
190
	if (count > file->f_maxcount)
191
	if (unlikely(count > file->f_maxcount))
191
		return -EINVAL;
192
		goto Einval;
193
	pos = *ppos;
194
	if (unlikely((pos < 0) || (loff_t) (pos + count) < 0))
195
		goto Einval;
192
196
193
	inode = file->f_dentry->d_inode;
197
	inode = file->f_dentry->d_inode;
194
	if (inode->i_flock && MANDATORY_LOCK(inode))
198
	if (inode->i_flock && MANDATORY_LOCK(inode))
195
		return locks_mandatory_area(read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, inode, file, *ppos, count);
199
		return locks_mandatory_area(read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE, inode, file, pos, count);
196
	return 0;
200
	return 0;
201
202
Einval:
203
	return -EINVAL;
197
}
204
}
198
205
199
ssize_t do_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *ppos)
206
ssize_t do_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *ppos)

Return to bug 65318