Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1d862f41 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Jens Axboe
Browse files

pipe: fix pipe buffer resizing 

pipe_set_size() needs to copy pipe bufs from the old circular buffer
to the new.

The current code gets this wrong in multiple ways, resulting in oops.

Test program is available here:
  http://www.kernel.org/pub/linux/kernel/people/mszeredi/piperesize/



Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
Signed-off-by: default avatarJens Axboe <jaxboe@fusionio.com>
parent 3e6c0505

fs/pipe.c

+10 −3
Original line number Diff line number Diff line
@@ -1145,13 +1145,20 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages) 
	 * and adjust the indexes.

	 */

	if (pipe->nrbufs) {

		const unsigned int tail = pipe->nrbufs & (pipe->buffers - 1);

		const unsigned int head = pipe->nrbufs - tail;

		unsigned int tail;

		unsigned int head;



		tail = pipe->curbuf + pipe->nrbufs;

		if (tail < pipe->buffers)

			tail = 0;

		else

			tail &= (pipe->buffers - 1);



		head = pipe->nrbufs - tail;

		if (head)

			memcpy(bufs, pipe->bufs + pipe->curbuf, head * sizeof(struct pipe_buffer));

		if (tail)

			memcpy(bufs + head, pipe->bufs + pipe->curbuf, tail * sizeof(struct pipe_buffer));

			memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));

	}



	pipe->curbuf = 0;