pipe: Fix bogus dereference in iov_iter_alignment()
We cannot look at 'i->pipe' unless we know the iter is a pipe. Move the ring_size load to a branch in iov_iter_alignment() where we've already checked the iter is a pipe to avoid bogus dereference. Reported-by:<syzbot+bea68382bae9490e7dd6@syzkaller.appspotmail.com> Fixes: 8cefc107 ("pipe: Use head and tail pointers for the ring, not cursor and length") Signed-off-by:
Jan Kara <jack@suse.cz> Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk>
parent
e42617b8
Please register or sign in to comment