Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9aefe431 authored by Dave Jones's avatar Dave Jones Committed by Jens Axboe
Browse files

[PATCH] splice: potential !page dereference 



We can get to out: with a NULL page, which we probably
don't want to be calling page_cache_release() on.

Signed-off-by: default avatarDave Jones <davej@redhat.com>
Signed-off-by: default avatarJens Axboe <axboe@suse.de>
parent c7f21e4f

fs/splice.c

+2 −1
Original line number Diff line number Diff line
@@ -445,7 +445,7 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf, 
		ret = -ENOMEM;

		page = find_or_create_page(mapping, index, gfp_mask);

		if (!page)

			goto out;

			goto out_nomem;



		/*

		 * If the page is uptodate, it is also locked. If it isn't
@@ -508,6 +508,7 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf, 
		page_cache_release(page);

		unlock_page(page);

	}

out_nomem:

	buf->ops->unmap(info, buf);

	return ret;

}