s390/crash: fix incorrect number of bytes to copy to user space

[ Upstream commit 675228ddf44cd157e84657fdf0a10ed226ca7d24 ]

The number of bytes in a chunk is correctly calculated, but instead
the total number of bytes is passed to copy_to_user_real() function.

Reported-by: Matthew Wilcox <willy@infradead.org>
Fixes: 056ae38a45b2 ("s390/dump: streamline oldmem copy functions")
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index 199f136d1644eeb39802da17dd054ef885d288f3..f17ad2daab0795a5b2a52b85122c4dee1dad301d 100644 (file)
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -198,7 +198,7 @@ static int copy_oldmem_user(void __user *dst, unsigned long src, size_t count)
                        } else {
                                len = count;
                        }
-                       rc = copy_to_user_real(dst, src, count);
+                       rc = copy_to_user_real(dst, src, len);
                        if (rc)
                                return rc;
                }