Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a860c97 authored by Jens Axboe's avatar Jens Axboe Committed by Linus Torvalds
Browse files

splice: fix bad unlock_page() in error case 



If add_to_page_cache_lru() fails, the page will not be locked. But
splice jumps to an error path that does a page release and unlock,
causing a BUG() in unlock_page().

Fix this by adding one more label that just releases the page. This bug
was actually triggered on EL5 by gurudas pai <gurudas.pai@oracle.com>
using fio.

Signed-off-by: default avatarJens Axboe <jens.axboe@oracle.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 9d1ca6f1

fs/splice.c

+3 −2
Original line number Diff line number Diff line
@@ -594,7 +594,7 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf, 
		ret = add_to_page_cache_lru(page, mapping, index,

					    GFP_KERNEL);

		if (unlikely(ret))

			goto out;

			goto out_release;

	}



	ret = mapping->a_ops->prepare_write(file, page, offset, offset+this_len);
@@ -650,8 +650,9 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf, 
	 */

	mark_page_accessed(page);

out:

	page_cache_release(page);

	unlock_page(page);

out_release:

	page_cache_release(page);

out_ret:

	return ret;

}