Make splice's iter_to_pipe() use iov_iter_extract_pages(). Splice requests
will rejected if the request if the cleanup mode is going to be anything
other than put_pages() since we're going to be attaching pages from the
iterator to a pipe and then returning to the caller, leaving the spliced
pages to their fates at some unknown time in the future.
Note this will cause some requests to fail that could work before - such as
splicing from an XARRAY-type iterator - if there's any way to do it as
extraction doesn't take refs or pins on non-user-backed iterators.
Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
cc: Christoph Hellwig <hch@xxxxxx>
cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
cc: linux-fsdevel@xxxxxxxxxxxxxxx
---
fs/splice.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/fs/splice.c b/fs/splice.c
index 19c5b5adc548..c3433266ba1b 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1159,14 +1159,18 @@ static int iter_to_pipe(struct iov_iter *from,
size_t total = 0;
int ret = 0;
+ /* For the moment, all pages attached to a pipe must have refs, not pins. */
+ if (WARN_ON(iov_iter_extract_mode(from, FOLL_SOURCE_BUF) != FOLL_GET))
+ return -EIO;
+
while (iov_iter_count(from)) {
- struct page *pages[16];
+ struct page *pages[16], **ppages = pages;
ssize_t left;
size_t start;
int i, n;
- left = iov_iter_get_pages(from, pages, ~0UL, 16, &start,
- FOLL_SOURCE_BUF);
+ left = iov_iter_extract_pages(from, &ppages, ~0UL, 16,
+ FOLL_SOURCE_BUF, &start);
if (left <= 0) {
ret = left;
break;
