summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2015-12-11 10:56:41 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2015-12-11 10:56:41 -0800
commit732c4a9e1404dfcce454122ae695dd9fb7939358 (patch)
tree9b88bd52c0b58604001655120eea5299a8ff2b20 /fs
parent4be460d96fa09b0136fe9c3ce3f1f299311f21e6 (diff)
parent3ca8138f014a913f98e6ef40e939868e1e9ea876 (diff)
downloadlinux-732c4a9e1404dfcce454122ae695dd9fb7939358.tar.gz
linux-732c4a9e1404dfcce454122ae695dd9fb7939358.tar.bz2
linux-732c4a9e1404dfcce454122ae695dd9fb7939358.zip
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse
Pull fuse fixes from Miklos Szeredi: "Two bugfixes, both bound for -stable" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: break infinite loop in fuse_fill_write_pages() cuse: fix memory leak
Diffstat (limited to 'fs')
-rw-r--r--fs/fuse/cuse.c2
-rw-r--r--fs/fuse/file.c2
2 files changed, 3 insertions, 1 deletions
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index eae2c11268bc..8e3ee1936c7e 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file)
unregister_chrdev_region(cc->cdev->dev, 1);
cdev_del(cc->cdev);
}
+ /* Base reference is now owned by "fud" */
+ fuse_conn_put(&cc->fc);
rc = fuse_dev_release(inode, file); /* puts the base reference */
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index e0faf8f2c868..570ca4053c80 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1049,6 +1049,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
flush_dcache_page(page);
+ iov_iter_advance(ii, tmp);
if (!tmp) {
unlock_page(page);
page_cache_release(page);
@@ -1061,7 +1062,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
req->page_descs[req->num_pages].length = tmp;
req->num_pages++;
- iov_iter_advance(ii, tmp);
count += tmp;
pos += tmp;
offset += tmp;