summaryrefslogtreecommitdiffstats
path: root/fs/pipe.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2019-10-07 16:30:51 +0100
committerDavid Howells <dhowells@redhat.com>2019-11-15 16:22:54 +0000
commit8df441294dd34fb0b16b45f550f55e96db6af4dc (patch)
tree7dc49acddd4b6585d146bbab6c24062237bf5407 /fs/pipe.c
parent7e25a73f1a52b58fc8206557e40d990cd791ad25 (diff)
downloadlinux-8df441294dd34fb0b16b45f550f55e96db6af4dc.tar.gz
linux-8df441294dd34fb0b16b45f550f55e96db6af4dc.tar.bz2
linux-8df441294dd34fb0b16b45f550f55e96db6af4dc.zip
pipe: Check for ring full inside of the spinlock in pipe_write()
Make pipe_write() check to see if the ring has become full between it taking the pipe mutex, checking the ring status and then taking the spinlock. This can happen if a notification is written into the pipe as that happens without the pipe mutex. Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'fs/pipe.c')
-rw-r--r--fs/pipe.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/pipe.c b/fs/pipe.c
index d7b8d3f22987..aba2455caabe 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -463,6 +463,11 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
spin_lock_irq(&pipe->wait.lock);
head = pipe->head;
+ if (pipe_full(head, pipe->tail, max_usage)) {
+ spin_unlock_irq(&pipe->wait.lock);
+ continue;
+ }
+
pipe->head = head + 1;
/* Always wake up, even if the copy fails. Otherwise