diff --git a/lab5/user/lab5/tmpfs/tmpfs.c b/lab5/user/lab5/tmpfs/tmpfs.c
index 4595064..d37c383 100644
--- a/lab5/user/lab5/tmpfs/tmpfs.c
+++ b/lab5/user/lab5/tmpfs/tmpfs.c
@@ -334,6 +334,7 @@ ssize_t tfs_file_write(struct inode * inode, off_t offset, const char *data,
 
 	u64 page_no, page_off;
 	u64 cur_off = offset;
+    u64 buf_off = 0;
 	size_t to_write, cur_to_write;
 	void *page;
 
@@ -359,10 +360,11 @@ ssize_t tfs_file_write(struct inode * inode, off_t offset, const char *data,
             radix_add(&inode->data, page_no, page);
         }
         // 写数据
-        memcpy(page + page_off, data + cur_off, cur_to_write);
+        memcpy(page + page_off, data + buf_off, cur_to_write);
 
         to_write -= cur_to_write;
         cur_off += cur_to_write;
+        buf_off += cur_to_write;
     }
 
     if (cur_off > inode->size) {
@@ -385,6 +387,7 @@ ssize_t tfs_file_read(struct inode * inode, off_t offset, char *buff,
 
 	u64 page_no, page_off;
 	u64 cur_off = offset;
+    u64 buf_off = 0;
 	size_t to_read, cur_to_read;
 	void *page;
 
@@ -406,12 +409,13 @@ ssize_t tfs_file_read(struct inode * inode, off_t offset, char *buff,
         }
         // 读取数据
         if (page == NULL) {
-            memset(buff + cur_off, 0, cur_to_read);
+            memset(buff + buf_off, 0, cur_to_read);
         } else {
-            memcpy(buff + cur_off, page + page_off, cur_to_read);
+            memcpy(buff + buf_off, page + page_off, cur_to_read);
         }
         to_read -= cur_to_read;
         cur_off += cur_to_read;
+        buf_off += cur_to_read;
     }
 
 	return cur_off - offset;