On Wed, Mar 20, 2024 at 09:47:26AM +0100, Laurent Vivier wrote:
...
  In write_remainder() 'skip' is the offset to
start the operation from
 in the iovec array.
 
 In iov_skip_bytes(), 'skip' is also the offset in the iovec array but
 'offset' is the first unskipped byte in the iovec entry.
 
 As write_remainder() uses 'skip' for both, 'skip' is reset to the
 first unskipped byte in the iovec entry rather to staying the first
 unskipped byte in the iovec array.
 
 Fix the problem by introducing a new variable not to overwrite 'skip'
 on each loop.
 
 Fixes: 8bdb0883b441 ("util: Add write_remainder() helper")
 Cc: david(a)gibson.dropbear.id.au
 Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> 
Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au>

...
  ---
 
 Notes:
     v2:
       - check offset != 0, not skip != 0
 
  util.c | 9 +++++----
  1 file changed, 5 insertions(+), 4 deletions(-)
 
 diff --git a/util.c b/util.c
 index 3b2393d6bfa8..849fa7f608c6 100644
 --- a/util.c
 +++ b/util.c
 @@ -533,13 +533,14 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t
stack_size, int flags,
  int write_remainder(int fd, const struct iovec *iov, int iovcnt, size_t skip)
  {
  	int i;
 +	size_t offset;
  
 -	while ((i = iov_skip_bytes(iov, iovcnt, skip, &skip)) < iovcnt) {
 +	while ((i = iov_skip_bytes(iov, iovcnt, skip, &offset)) < iovcnt) {
  		ssize_t rc;
  
 -		if (skip) {
 -			rc = write(fd, (char *)iov[i].iov_base + skip,
 -				   iov[i].iov_len - skip);
 +		if (offset) {
 +			rc = write(fd, (char *)iov[i].iov_base + offset,
 +				   iov[i].iov_len - offset);
  		} else {
  			rc = writev(fd, &iov[i], iovcnt - i);
  		} 
-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson