diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2015-12-11 19:56:41 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2015-12-11 19:56:41 +0100 |
| commit | 732c4a9e1404dfcce454122ae695dd9fb7939358 (patch) | |
| tree | 9b88bd52c0b58604001655120eea5299a8ff2b20 /fs/fuse | |
| parent | Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux (diff) | |
| parent | fuse: break infinite loop in fuse_fill_write_pages() (diff) | |
| download | linux-732c4a9e1404dfcce454122ae695dd9fb7939358.tar.xz linux-732c4a9e1404dfcce454122ae695dd9fb7939358.zip | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse fixes from Miklos Szeredi:
"Two bugfixes, both bound for -stable"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
fuse: break infinite loop in fuse_fill_write_pages()
cuse: fix memory leak
Diffstat (limited to 'fs/fuse')
| -rw-r--r-- | fs/fuse/cuse.c | 2 | ||||
| -rw-r--r-- | fs/fuse/file.c | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c index eae2c11268bc..8e3ee1936c7e 100644 --- a/fs/fuse/cuse.c +++ b/fs/fuse/cuse.c @@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file) unregister_chrdev_region(cc->cdev->dev, 1); cdev_del(cc->cdev); } + /* Base reference is now owned by "fud" */ + fuse_conn_put(&cc->fc); rc = fuse_dev_release(inode, file); /* puts the base reference */ diff --git a/fs/fuse/file.c b/fs/fuse/file.c index e0faf8f2c868..570ca4053c80 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -1049,6 +1049,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes); flush_dcache_page(page); + iov_iter_advance(ii, tmp); if (!tmp) { unlock_page(page); page_cache_release(page); @@ -1061,7 +1062,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, req->page_descs[req->num_pages].length = tmp; req->num_pages++; - iov_iter_advance(ii, tmp); count += tmp; pos += tmp; offset += tmp; |