From afcd3cc9d1d3f08105d8643a0d5a0e08876beb83 Mon Sep 17 00:00:00 2001
From: Dave Hansen <haveblue@us.ibm.com>
Date: Sat, 16 Apr 2005 15:25:49 -0700
Subject: [PATCH] --- yaml --- r: 136 b: refs/heads/master c:
 1f08ad02379530e1c970d3d104343b9907b4d1b4 h: refs/heads/master v: v3

---
 [refs]                | 2 +-
 trunk/fs/read_write.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index 815ba002f037..48c066b53d6a 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 22a685d09bb98810670ac0fb02c2138bdbf038cc
+refs/heads/master: 1f08ad02379530e1c970d3d104343b9907b4d1b4
diff --git a/trunk/fs/read_write.c b/trunk/fs/read_write.c
index 6be4b1a1956b..c4c2bee373ed 100644
--- a/trunk/fs/read_write.c
+++ b/trunk/fs/read_write.c
@@ -467,10 +467,10 @@ static ssize_t do_readv_writev(int type, struct file *file,
 		void __user *buf = iov[seg].iov_base;
 		ssize_t len = (ssize_t)iov[seg].iov_len;
 
-		if (unlikely(!access_ok(vrfy_dir(type), buf, len)))
-			goto Efault;
 		if (len < 0)	/* size_t not fitting an ssize_t .. */
 			goto out;
+		if (unlikely(!access_ok(vrfy_dir(type), buf, len)))
+			goto Efault;
 		tot_len += len;
 		if ((ssize_t)tot_len < 0) /* maths overflow on the ssize_t */
 			goto out;