iov_iter_get_pages{,_alloc}(): cap the maxsize with MAX_RW_COUNT

All callers can and should handle iov_iter_get_pages() returning
fewer pages than requested.  All in-kernel ones do.  And it makes
the arithmetical overflow analysis much simpler...

Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index c513146396155ec8b0883a9a1e871d69b26cc830..225b968ed8c5e4b6b24877cb15c2bf0c1204d29f 100644 (file)
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1348,6 +1348,8 @@ ssize_t iov_iter_get_pages(struct iov_iter *i,
                maxsize = i->count;
        if (!maxsize)
                return 0;
+       if (maxsize > MAX_RW_COUNT)
+               maxsize = MAX_RW_COUNT;
 
        if (likely(iter_is_iovec(i))) {
                unsigned int gup_flags = 0;
@@ -1474,6 +1476,8 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
                maxsize = i->count;
        if (!maxsize)
                return 0;
+       if (maxsize > MAX_RW_COUNT)
+               maxsize = MAX_RW_COUNT;
 
        if (likely(iter_is_iovec(i))) {
                unsigned int gup_flags = 0;