Skip to content
Commit e0ff126e authored by Jan Kara's avatar Jan Kara Committed by Al Viro
Browse files

pipe: Fix bogus dereference in iov_iter_alignment()



We cannot look at 'i->pipe' unless we know the iter is a pipe. Move the
ring_size load to a branch in iov_iter_alignment() where we've already
checked the iter is a pipe to avoid bogus dereference.

Reported-by: default avatar <syzbot+bea68382bae9490e7dd6@syzkaller.appspotmail.com>
Fixes: 8cefc107

 ("pipe: Use head and tail pointers for the ring, not cursor and length")
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent e42617b8
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment