[PATCH] splice: fix bugs with stealing regular pipe pages

- Check that page has suitable count for stealing in the regular pipes.
- pipe_to_file() assumes that the page is locked on succesful steal, so
  do that in the pipe steal hook
- Missing unlock_page() in add_to_page_cache() failure.

Signed-off-by: Jens Axboe <axboe@suse.de>

diff --git a/fs/pipe.c b/fs/pipe.c
index 7fefb10db8d9d6ad2a187d3c352cd0557beb30f5..5a369273c51b815465075f6c13ad5e65e4cbc031 100644 (file)
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -127,8 +127,15 @@ static void anon_pipe_buf_unmap(struct pipe_inode_info *pipe,
 static int anon_pipe_buf_steal(struct pipe_inode_info *pipe,
                               struct pipe_buffer *buf)
 {
-       buf->flags |= PIPE_BUF_FLAG_STOLEN;
-       return 0;
+       struct page *page = buf->page;
+
+       if (page_count(page) == 1) {
+               buf->flags |= PIPE_BUF_FLAG_STOLEN;
+               lock_page(page);
+               return 0;
+       }
+
+       return 1;
 }
 
 static void anon_pipe_buf_get(struct pipe_inode_info *info,

diff --git a/fs/splice.c b/fs/splice.c
index a46ddd28561ea2ed74ae133d20c8220425f3651f..9df28d30efa0ede1eb5f149fd342d3f1c5b6cd8e 100644 (file)
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -599,8 +599,10 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
                        goto find_page;
 
                page = buf->page;
-               if (add_to_page_cache(page, mapping, index, gfp_mask))
+               if (add_to_page_cache(page, mapping, index, gfp_mask)) {
+                       unlock_page(page);
                        goto find_page;
+               }
 
                if (!(buf->flags & PIPE_BUF_FLAG_LRU))
                        lru_cache_add(page);