Jan Kara e0ff126ee7 pipe: Fix bogus dereference in iov_iter_alignment()
We cannot look at 'i->pipe' unless we know the iter is a pipe. Move the
ring_size load to a branch in iov_iter_alignment() where we've already
checked the iter is a pipe to avoid bogus dereference.

Reported-by: syzbot+bea68382bae9490e7dd6@syzkaller.appspotmail.com
Fixes: 8cefc107ca54 ("pipe: Use head and tail pointers for the ring, not cursor and length")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2019-12-16 12:48:10 -05:00
..
2019-09-20 09:06:26 -07:00
2018-08-22 10:52:48 -07:00
2018-10-12 09:17:46 +02:00
2018-08-16 12:14:42 -07:00
2018-08-22 10:52:48 -07:00
2019-12-03 13:58:22 -08:00
2014-04-30 19:49:37 +01:00
2017-02-24 17:46:57 -08:00
2019-12-07 11:00:19 -08:00
2019-12-07 11:00:19 -08:00
2019-12-07 11:00:19 -08:00
2019-12-05 11:43:31 -08:00
2018-10-16 13:45:44 +02:00
2019-07-11 15:17:41 -07:00
2019-07-11 15:17:41 -07:00
2018-06-27 18:58:49 +03:00
2018-10-15 16:31:29 -04:00
2019-12-01 12:59:05 -08:00
2017-08-15 09:02:07 -07:00