@@ -91,13 +91,16 @@ static ssize_t xip_io(int rw, struct inode *inode, const struct
{
ssize_t retval = 0;
unsigned seg = 0;
- unsigned len;
+ unsigned len, total_len;
unsigned copied = 0;
loff_t offset = start;
loff_t max = start;
void *addr;
bool hole = false;
+ end = min(end, inode->i_size);
+ total_len = end - start;
+
while (offset < end) {
void __user *buf = iov[seg].iov_base + copied;
@@ -136,6 +139,7 @@ static ssize_t xip_io(int rw, struct inode *inode, const struct
}
len = min_t(unsigned, iov[seg].iov_len - copied, max - offset);
+ len = min(len, total_len);
if (rw == WRITE)
len -= __copy_from_user_nocache(addr, buf, len);
@@ -149,6 +153,7 @@ static ssize_t xip_io(int rw, struct inode *inode, const struct
offset += len;
copied += len;
+ total_len -= len;
if (copied == iov[seg].iov_len) {
seg++;
copied = 0;