Commit d9b58ab7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull copy_to_iter_mc fix from Al Viro:
 "Backportable fix for copy_to_iter_mc() - the second part of iov_iter
  work will pretty much overwrite this, but would be much harder to
  backport"

* tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fix short copy handling in copy_mc_pipe_to_iter()
parents 5264406c c3497fd0

include/linux/pipe_fs_i.h

+9 −0
Original line number Diff line number Diff line
@@ -229,6 +229,15 @@ static inline bool pipe_buf_try_steal(struct pipe_inode_info *pipe, 
	return buf->ops->try_steal(pipe, buf);

}



static inline void pipe_discard_from(struct pipe_inode_info *pipe,

		unsigned int old_head)

{

	unsigned int mask = pipe->ring_size - 1;



	while (pipe->head > old_head)

		pipe_buf_release(pipe, &pipe->bufs[--pipe->head & mask]);

}



/* Differs from PIPE_BUF in that PIPE_SIZE is the length of the actual

   memory allocation, whereas PIPE_BUF makes atomicity guarantees.  */

#define PIPE_SIZE		PAGE_SIZE

lib/iov_iter.c

+11 −4
Original line number Diff line number Diff line
@@ -521,6 +521,7 @@ static size_t copy_mc_pipe_to_iter(const void *addr, size_t bytes, 
	struct pipe_inode_info *pipe = i->pipe;

	unsigned int p_mask = pipe->ring_size - 1;

	unsigned int i_head;

	unsigned int valid = pipe->head;

	size_t n, off, xfer = 0;



	if (!sanity(i))
@@ -534,11 +535,17 @@ static size_t copy_mc_pipe_to_iter(const void *addr, size_t bytes, 
		rem = copy_mc_to_kernel(p + off, addr + xfer, chunk);

		chunk -= rem;

		kunmap_local(p);

		if (chunk) {

			i->head = i_head;

			i->iov_offset = off + chunk;

			xfer += chunk;

		if (rem)

			valid = i_head + 1;

		}

		if (rem) {

			pipe->bufs[i_head & p_mask].len -= rem;

			pipe_discard_from(pipe, valid);

			break;

		}

		n -= chunk;

		off = 0;

		i_head++;