search for: pipe_unlock

.../char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -870,6 +870,7 @@ struct sg_list { struct scatterlist *sg; }; +#ifdef CONFIG_SYSCALL_SPLICE static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf, struct splice_desc *sd) { @@ -976,6 +977,7 @@ error_out: pipe_unlock(pipe); return ret; } +#endif /* #ifdef CONFIG_SYSCALL_SPLICE */ static unsigned int port_fops_poll(struct file *filp, poll_table *wait) { @@ -1109,7 +1111,7 @@ static const struct file_operations port_fops = { .open = port_fops_open, .read = port_fops_read, .write = port_fops_write,...

.../char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -870,6 +870,7 @@ struct sg_list { struct scatterlist *sg; }; +#ifdef CONFIG_SYSCALL_SPLICE static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf, struct splice_desc *sd) { @@ -976,6 +977,7 @@ error_out: pipe_unlock(pipe); return ret; } +#endif /* #ifdef CONFIG_SYSCALL_SPLICE */ static unsigned int port_fops_poll(struct file *filp, poll_table *wait) { @@ -1109,7 +1111,7 @@ static const struct file_operations port_fops = { .open = port_fops_open, .read = port_fops_read, .write = port_fops_write,...

...-ENOMEM; + if (!buf) { + ret = -ENOMEM; + goto error_out; + } sgl.n = 0; sgl.len = 0; @@ -953,12 +958,17 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, sgl.sg = buf->sg; sg_init_table(sgl.sg, sgl.size); ret = __splice_from_pipe(pipe, &sd, pipe_to_sg); + pipe_unlock(pipe); if (likely(ret > 0)) ret = __send_to_port(port, buf->sg, sgl.n, sgl.len, buf, true); if (unlikely(ret <= 0)) free_buf(buf, true); return ret; + +error_out: + pipe_unlock(pipe); + return ret; } static unsigned int port_fops_poll(struct file *filp, poll_table *wait)

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

...onsole.c > @@ -870,6 +870,7 @@ struct sg_list { > struct scatterlist *sg; > }; > > +#ifdef CONFIG_SYSCALL_SPLICE > static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf, > struct splice_desc *sd) > { > @@ -976,6 +977,7 @@ error_out: > pipe_unlock(pipe); > return ret; > } > +#endif /* #ifdef CONFIG_SYSCALL_SPLICE */ Not worth the #ifdef mess.