From f029d242073834bf5caa365909424425ea299a26 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Sat, 9 Jan 2021 16:02:57 +0000 Subject: [PATCH] splice: don't generate zero-len segement bvecs iter_file_splice_write() may spawn bvec segments with zero-length. In preparation for prohibiting them, filter out by hand at splice level. Reviewed-by: Christoph Hellwig Signed-off-by: Pavel Begunkov Reviewed-by: Ming Lei Signed-off-by: Jens Axboe (cherry picked from commit 0f1d344feb534555a0dcd0beafb7211a37c5355e) (cherry picked from commit 4c72fdc13bd20d10f59b8145627312814583a945) (cherry picked from commit cba6a18da1cc8144a07ba6a4b03e8e8dc8d24428) (cherry picked from commit 54a17499483118cd3c92feb747c88207ce30e9ce) (cherry picked from commit 4dec661d05c16a8e62dd833262ff68ce3e466770) (cherry picked from commit fe99d86b681099f662b2b01155b02b8476ff428d) (cherry picked from commit aa033460cd26157fe81e829e4744b3396a09860b) --- fs/splice.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/splice.c b/fs/splice.c index 036a47937..fcf05a364 100755 --- a/fs/splice.c +++ b/fs/splice.c @@ -662,12 +662,14 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out, /* build the vector */ left = sd.total_len; - for (n = 0; !pipe_empty(head, tail) && left && n < nbufs; tail++, n++) { + for (n = 0; !pipe_empty(head, tail) && left && n < nbufs; tail++) { struct pipe_buffer *buf = &pipe->bufs[tail & mask]; size_t this_len = buf->len; - if (this_len > left) - this_len = left; + /* zero-length bvecs are not supported, skip them */ + if (!this_len) + continue; + this_len = min(this_len, left); ret = pipe_buf_confirm(pipe, buf); if (unlikely(ret)) { @@ -680,6 +682,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out, array[n].bv_len = this_len; array[n].bv_offset = buf->offset; left -= this_len; + n++; } iov_iter_bvec(&from, WRITE, array, n, sd.total_len - left);