Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
To:     Shyam Prasad N <sprasad@microsoft.com>
cc:     dhowells@redhat.com, Steve French <smfrench@gmail.com>,
        Rohith Surabattula <rohiths.msft@gmail.com>,
        Paulo Alcantara <pc@manguebit.com>,
        Tom Talpey <tom@talpey.com>, Jeff Layton <jlayton@kernel.org>,
        linux-cifs@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH] cifs: Fix cifs_limit_bvec_subset() to correctly check the maxmimum size
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2811950.1684766430.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Mon, 22 May 2023 15:40:30 +0100
Message-ID: <2811951.1684766430@warthog.procyon.org.uk>
Precedence: bulk

Fix cifs_limit_bvec_subset() so that it limits the span to the maximum
specified and won't return with a size greater than max_size.

Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather=
 than a page list")
Reported-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Steve French <smfrench@gmail.com>
cc: Rohith Surabattula <rohiths.msft@gmail.com>
cc: Paulo Alcantara <pc@manguebit.com>
cc: Tom Talpey <tom@talpey.com>
cc: Jeff Layton <jlayton@kernel.org>
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
---
 fs/cifs/file.c |    1 +
 1 file changed, 1 insertion(+)


diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index ba7f2e09d6c8..4778614cfccf 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -3353,6 +3353,7 @@ static size_t cifs_limit_bvec_subset(const struct io=
v_iter *iter, size_t max_siz
 	while (n && ix < nbv) {
 		len =3D min3(n, bvecs[ix].bv_len - skip, max_size);
 		span +=3D len;
+		max_size -=3D len;
 		nsegs++;
 		ix++;
 		if (span >=3D max_size || nsegs >=3D max_segs)