diff options
author | Stephen Rothwell <sfr@canb.auug.org.au> | 2017-03-10 10:02:15 +1100 |
---|---|---|
committer | Stephen Rothwell <sfr@canb.auug.org.au> | 2017-03-10 10:02:18 +1100 |
commit | 414b6a07eab8feeb9bb50c3908acfdf42b3063d9 (patch) | |
tree | 8f11c8e8bdb7d1d7e25d735a7b972f384341646b /fs | |
parent | a7798c4e2332c71a42754e33f29d4d409aa7229e (diff) | |
parent | 9e9c5ba8bd70714708bc9ae9b557eb8141f1de74 (diff) |
Merge remote-tracking branch 'vfs/for-next'
Diffstat (limited to 'fs')
-rw-r--r-- | fs/splice.c | 22 | ||||
-rw-r--r-- | fs/xattr.c | 20 |
2 files changed, 25 insertions, 17 deletions
diff --git a/fs/splice.c b/fs/splice.c index 006ba50f4ece..9299b59511b9 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -247,11 +247,6 @@ ssize_t add_to_pipe(struct pipe_inode_info *pipe, struct pipe_buffer *buf) } EXPORT_SYMBOL(add_to_pipe); -void spd_release_page(struct splice_pipe_desc *spd, unsigned int i) -{ - put_page(spd->pages[i]); -} - /* * Check if we need to grow the arrays holding pages and partial page * descriptions. @@ -308,6 +303,8 @@ ssize_t generic_file_splice_read(struct file *in, loff_t *ppos, iov_iter_pipe(&to, ITER_PIPE | READ, pipe, len); idx = to.idx; init_sync_kiocb(&kiocb, in); + if (flags & SPLICE_F_NONBLOCK) + kiocb.ki_flags |= IOCB_NDELAY; kiocb.ki_pos = *ppos; ret = call_read_iter(in, &kiocb, &to); if (ret > 0) { @@ -393,7 +390,7 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos, struct iov_iter to; struct page **pages; unsigned int nr_pages; - size_t offset, dummy, copied = 0; + size_t offset, base, copied = 0; ssize_t res; int i; @@ -408,12 +405,11 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos, iov_iter_pipe(&to, ITER_PIPE | READ, pipe, len + offset); - res = iov_iter_get_pages_alloc(&to, &pages, len + offset, &dummy); + res = iov_iter_get_pages_alloc(&to, &pages, len + offset, &base); if (res <= 0) return -ENOMEM; - BUG_ON(dummy); - nr_pages = DIV_ROUND_UP(res, PAGE_SIZE); + nr_pages = DIV_ROUND_UP(res + base, PAGE_SIZE); vec = __vec; if (nr_pages > PIPE_DEF_BUFFERS) { @@ -1359,6 +1355,8 @@ SYSCALL_DEFINE4(vmsplice, int, fd, const struct iovec __user *, iov, struct fd f; long error; + if (unlikely(flags & ~SPLICE_F_ALL)) + return -EINVAL; if (unlikely(nr_segs > UIO_MAXIOV)) return -EINVAL; else if (unlikely(!nr_segs)) @@ -1409,6 +1407,9 @@ SYSCALL_DEFINE6(splice, int, fd_in, loff_t __user *, off_in, if (unlikely(!len)) return 0; + if (unlikely(flags & ~SPLICE_F_ALL)) + return -EINVAL; + error = -EBADF; in = fdget(fd_in); if (in.file) { @@ -1737,6 +1738,9 @@ SYSCALL_DEFINE4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags) struct fd in; int error; + if (unlikely(flags & ~SPLICE_F_ALL)) + return -EINVAL; + if (unlikely(!len)) return 0; diff --git a/fs/xattr.c b/fs/xattr.c index 7e3317cf4045..c19a16323c2c 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -537,16 +537,18 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, } error = vfs_getxattr(d, kname, kvalue, size); + if (error > XATTR_SIZE_MAX || + (error == -ERANGE && size >= XATTR_SIZE_MAX)) { + /* The file system tried to returned a value bigger + than XATTR_SIZE_MAX bytes. Not possible. */ + error = -E2BIG; + } if (error > 0) { if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) || (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0)) posix_acl_fix_xattr_to_user(kvalue, size); if (size && copy_to_user(value, kvalue, error)) error = -EFAULT; - } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) { - /* The file system tried to returned a value bigger - than XATTR_SIZE_MAX bytes. Not possible. */ - error = -E2BIG; } kvfree(kvalue); @@ -620,14 +622,16 @@ listxattr(struct dentry *d, char __user *list, size_t size) } error = vfs_listxattr(d, klist, size); - if (error > 0) { - if (size && copy_to_user(list, klist, error)) - error = -EFAULT; - } else if (error == -ERANGE && size >= XATTR_LIST_MAX) { + if (error > XATTR_LIST_MAX || + (error == -ERANGE && size >= XATTR_LIST_MAX)) { /* The file system tried to returned a list bigger than XATTR_LIST_MAX bytes. Not possible. */ error = -E2BIG; } + if (error > 0) { + if (size && copy_to_user(list, klist, error)) + error = -EFAULT; + } kvfree(klist); |