Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 25 Nov 2019 15:03:26 -0800
From:   "Darrick J. Wong" <djwong@kernel.org>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     "Darrick J. Wong" <djwong@kernel.org>,
        linux-fsdevel@vger.kernel.org, linux-xfs@vger.kernel.org,
        linux-kernel@vger.kernel.org, agruenba@redhat.com
Subject: [GIT PULL] splice: fix for 5.5
Message-ID: <20191125230326.GS6211@magnolia>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.9.4 (2018-02-28)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Linus,

Please pull this single patch for 5.5 that fixes some questionable pipe
behavior in the splice code.  Specifically, whenever we perform a read
into a pipe, we now clamp the read request to the length of the pipe
buffer since there's no point in asking for more than we can handle.
We already fixed this in one place, but Andreas Gruenbacher found
another place where we could overflow, and requested a second fix.

The branch merges cleanly against this morning's HEAD and survived a few
days' worth of xfstests.  The merge was completely straightforward, so
please let me know if you run into anything weird.

--D

The following changes since commit 4f5cafb5cb8471e54afdc9054d973535614f7675:

  Linux 5.4-rc3 (2019-10-13 16:37:36 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git tags/vfs-5.5-merge-1

for you to fetch changes up to 3253d9d093376d62b4a56e609f15d2ec5085ac73:

  splice: only read in as much information as there is pipe buffer space (2019-10-15 08:44:32 -0700)

----------------------------------------------------------------
New code for 5.5:
- Fix another place in the splice code where a pipe could ask a
filesystem for a longer read than the pipe actually has free buffer
space.

----------------------------------------------------------------
Darrick J. Wong (1):
      splice: only read in as much information as there is pipe buffer space

 fs/splice.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)