diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2016-04-04 01:53:20 +0200 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2016-04-04 01:53:20 +0200 |
| commit | 7367ab9157d6829351dd4aa404352402f064686c (patch) | |
| tree | 810335bdb021051dd8de6b83c198145593e91912 /fs | |
| parent | rw_verify_area(): saner calling conventions (diff) | |
| parent | do_splice_to(): cap the size before passing to ->splice_read() (diff) | |
| download | linux-7367ab9157d6829351dd4aa404352402f064686c.tar.xz linux-7367ab9157d6829351dd4aa404352402f064686c.zip | |
Merge branch 'for-linus' into work.iov_iter
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/namei.c | 10 | ||||
| -rw-r--r-- | fs/splice.c | 3 |
2 files changed, 9 insertions, 4 deletions
diff --git a/fs/namei.c b/fs/namei.c index 794f81dce766..1d9ca2d5dff6 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1740,15 +1740,17 @@ static int walk_component(struct nameidata *nd, int flags) nd->flags); if (IS_ERR(path.dentry)) return PTR_ERR(path.dentry); - if (unlikely(d_is_negative(path.dentry))) { - dput(path.dentry); - return -ENOENT; - } + path.mnt = nd->path.mnt; err = follow_managed(&path, nd); if (unlikely(err < 0)) return err; + if (unlikely(d_is_negative(path.dentry))) { + path_to_nameidata(&path, nd); + return -ENOENT; + } + seq = 0; /* we are already out of RCU mode */ inode = d_backing_inode(path.dentry); } diff --git a/fs/splice.c b/fs/splice.c index 9947b5c69664..a6b87b7e0745 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -1143,6 +1143,9 @@ static long do_splice_to(struct file *in, loff_t *ppos, if (unlikely(ret < 0)) return ret; + if (unlikely(len > MAX_RW_COUNT)) + len = MAX_RW_COUNT; + if (in->f_op->splice_read) splice_read = in->f_op->splice_read; else |