Don't let parts of multipage folios be gifted by (vm)splice into a pipe as the other end may only be expecting single-page gifts (fuse and virtio console for example). replace_page_cache_folio(), for example, will do the wrong thing if it tries to replace a single paged folio with a multipage folio. Try to avoid this by making add_to_pipe() remove the gift flag on multipage folios. Signed-off-by: David Howells <dhowells@xxxxxxxxxx> cc: Matthew Wilcox <willy@xxxxxxxxxxxxx> cc: Miklos Szeredi <miklos@xxxxxxxxxx> cc: Amit Shah <amit@xxxxxxxxxx> cc: linux-fsdevel@xxxxxxxxxxxxxxx cc: virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx cc: linux-mm@xxxxxxxxx --- fs/splice.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/splice.c b/fs/splice.c index 2e76dbb81a8f..33caa28a86e4 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -240,6 +240,8 @@ ssize_t add_to_pipe(struct pipe_inode_info *pipe, struct pipe_buffer *buf) } else if (pipe_full(head, tail, pipe->max_usage)) { ret = -EAGAIN; } else { + if (folio_nr_pages(page_folio(buf->page)) > 1) + buf->flags &= ~PIPE_BUF_FLAG_GIFT; pipe->bufs[head & mask] = *buf; pipe->head = head + 1; return buf->len;