Eric Dumazet 047fe36052 splice: fix racy pipe->buffers uses
Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered
by splice_shrink_spd() called from vmsplice_to_pipe()

commit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)
added capability to adjust pipe->buffers.

Problem is some paths don't hold pipe mutex and assume pipe->buffers
doesn't change for their duration.

Fix this by adding nr_pages_max field in struct splice_pipe_desc, and
use it in place of pipe->buffers where appropriate.

splice_shrink_spd() loses its struct pipe_inode_info argument.

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Tom Herbert <therbert@google.com>
Cc: stable <stable@vger.kernel.org> # 2.6.35
Tested-by: Dave Jones <davej@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2012-06-13 21:16:42 +02:00
..
2012-04-04 17:26:08 -07:00
2011-07-26 16:49:45 -07:00
2012-06-13 21:16:42 +02:00
2011-03-14 09:15:23 -04:00
2012-05-21 23:52:30 -04:00
2012-05-31 17:49:27 -07:00
2011-07-14 12:59:14 +03:00
2012-03-28 18:30:03 +01:00
2012-05-31 17:49:32 -07:00
2012-05-31 17:49:28 -07:00
2012-05-29 23:28:41 -04:00
2012-03-29 19:52:46 +08:00
2012-06-13 21:16:42 +02:00
2012-03-28 18:30:03 +01:00
2012-06-01 12:58:52 -04:00
2012-05-08 12:35:06 +02:00
2012-05-31 17:49:32 -07:00
2011-09-19 17:04:37 -07:00
2012-03-15 18:17:55 -07:00
2012-05-19 15:44:40 -06:00