splice: only read in as much information as there is pipe buffer space
commit70d3c881e8abf0bd3342b7f52fe1ec7eb4c7eac4
authorDarrick J. Wong <darrick.wong@oracle.com>
Tue, 15 Oct 2019 15:44:32 +0000 (15 08:44 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Dec 2019 18:56:52 +0000 (17 19:56 +0100)
tree6c246762e2682c52f7720e4ef1e17d8dfe77ef58
parentb44f9cd36bbc699d7dc71c99e4b7dabcd4fd55d8
splice: only read in as much information as there is pipe buffer space

commit 3253d9d093376d62b4a56e609f15d2ec5085ac73 upstream.

Andreas Grünbacher reports that on the two filesystems that support
iomap directio, it's possible for splice() to return -EAGAIN (instead of
a short splice) if the pipe being written to has less space available in
its pipe buffers than the length supplied by the calling process.

Months ago we fixed splice_direct_to_actor to clamp the length of the
read request to the size of the splice pipe.  Do the same to do_splice.

Fixes: 17614445576b6 ("splice: don't read more than available pipe space")
Reported-by: syzbot+3c01db6025f26530cf8d@syzkaller.appspotmail.com
Reported-by: Andreas Grünbacher <andreas.gruenbacher@gmail.com>
Reviewed-by: Andreas Grünbacher <andreas.gruenbacher@gmail.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/splice.c