diff options
| author | Miklos Szeredi <mszeredi@suse.cz> | 2008-07-04 09:35:17 +0200 |
|---|---|---|
| committer | Jens Axboe <jens.axboe@oracle.com> | 2008-07-04 09:52:14 +0200 |
| commit | 32502b8413a77b54b9e19809404109590c32dfb7 (patch) | |
| tree | c84b87396be32d529b9902a7261b772b1d919e8b /fs/splice.c | |
| parent | 8b3d3567f72aa61d5d6f4ce89d289b154e1ea866 (diff) | |
| download | linux-stable-32502b8413a77b54b9e19809404109590c32dfb7.tar.gz linux-stable-32502b8413a77b54b9e19809404109590c32dfb7.tar.bz2 linux-stable-32502b8413a77b54b9e19809404109590c32dfb7.zip | |
splice: fix generic_file_splice_read() race with page invalidation
If a page was invalidated during splicing from file to a pipe, then
generic_file_splice_read() could return a short or zero count.
This manifested itself in rare I/O errors seen on nfs exported fuse
filesystems. This is because nfsd uses splice_direct_to_actor() to read
files, and fuse uses invalidate_inode_pages2() to invalidate stale data on
open.
Fix by redoing the page find/create if it was found to be truncated
(invalidated).
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Diffstat (limited to 'fs/splice.c')
| -rw-r--r-- | fs/splice.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/fs/splice.c b/fs/splice.c index aa5f6f60b305..399442179d89 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -379,13 +379,22 @@ __generic_file_splice_read(struct file *in, loff_t *ppos, lock_page(page); /* - * page was truncated, stop here. if this isn't the - * first page, we'll just complete what we already - * added + * Page was truncated, or invalidated by the + * filesystem. Redo the find/create, but this time the + * page is kept locked, so there's no chance of another + * race with truncate/invalidate. */ if (!page->mapping) { unlock_page(page); - break; + page = find_or_create_page(mapping, index, + mapping_gfp_mask(mapping)); + + if (!page) { + error = -ENOMEM; + break; + } + page_cache_release(pages[page_nr]); + pages[page_nr] = page; } /* * page was already under io and is now done, great |