A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 11:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

[PATCH] splice: fix bugs in pipe_to_file()

Browse source 
Found by Oleg Nesterov <[email protected]>, fixed by me.

- Only allow full pages to go to the page cache.
- Check page != buf->page instead of using PIPE_BUF_FLAG_STOLEN.
- Remember to clear 'stolen' if add_to_page_cache() fails.

And as a cleanup on that:

- Make the bottom fall-through logic a little less convoluted. Also make
  the steal path hold an extra reference to the page, so we don't have
  to differentiate between stolen and non-stolen at the end.

Signed-off-by: Jens Axboe <[email protected]>
This commit is contained in:
Jens Axboe 2006-05-01 19:50:48 +02:00
commit 0568b409c7
3 changed files with 20 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

3
fs/pipe.c
View file

@ -99,8 +99,6 @@ static void anon_pipe_buf_release(struct pipe_inode_info *pipe,
{
struct page *page = buf->page;
buf->flags &= ~PIPE_BUF_FLAG_STOLEN;
/*
* If nobody else uses this page, and we don't already have a
* temporary page, let's keep track of it as a one-deep
@ -130,7 +128,6 @@ static int anon_pipe_buf_steal(struct pipe_inode_info *pipe,
struct page *page = buf->page;
if (page_count(page) == 1) {
buf->flags |= PIPE_BUF_FLAG_STOLEN;
lock_page(page);
return 0;
}