Anton Altaparmakov points out: - It calls fault_in_pages_readable() which is completely bogus if @nr_segs > 1. It needs to be replaced by a to be written "fault_in_pages_readable_iovec()". - It increments @buf even in the iovec case thus @buf can point to random memory really quickly (in the iovec case) and then it calls fault_in_pages_readable() on this random memory. Signed-off-by: Andrew Morton --- mm/filemap.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff -puN mm/filemap.c~generic_file_buffered_write-fixes mm/filemap.c --- 25/mm/filemap.c~generic_file_buffered_write-fixes 2005-04-27 00:11:03.385738280 -0700 +++ 25-akpm/mm/filemap.c 2005-04-27 00:11:03.390737520 -0700 @@ -1949,7 +1949,7 @@ generic_file_buffered_write(struct kiocb buf = iov->iov_base + written; else { filemap_set_next_iovec(&cur_iov, &iov_base, written); - buf = iov->iov_base + iov_base; + buf = cur_iov->iov_base + iov_base; } do { @@ -2007,9 +2007,11 @@ generic_file_buffered_write(struct kiocb count -= status; pos += status; buf += status; - if (unlikely(nr_segs > 1)) + if (unlikely(nr_segs > 1)) { filemap_set_next_iovec(&cur_iov, &iov_base, status); + buf = cur_iov->iov_base + iov_base; + } } } if (unlikely(copied != bytes)) _