diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2016-04-02 14:56:58 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2016-04-03 19:52:59 -0400 |
| commit | 03cc0789a690eb9ab07070376252961caeae7441 (patch) | |
| tree | 571ea10fc6edaf214c0442494793a6635d05c045 /fs/splice.c | |
| parent | 7500c38ac3258815f86f41744a538850c3221b23 (diff) | |
| download | linux-0-day-03cc0789a690eb9ab07070376252961caeae7441.tar.gz linux-0-day-03cc0789a690eb9ab07070376252961caeae7441.tar.xz | |
do_splice_to(): cap the size before passing to ->splice_read()
pipe capacity won't exceed 2G anyway.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/splice.c')
| -rw-r--r-- | fs/splice.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/splice.c b/fs/splice.c index 9947b5c696649..a6b87b7e07455 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -1143,6 +1143,9 @@ static long do_splice_to(struct file *in, loff_t *ppos, if (unlikely(ret < 0)) return ret; + if (unlikely(len > MAX_RW_COUNT)) + len = MAX_RW_COUNT; + if (in->f_op->splice_read) splice_read = in->f_op->splice_read; else |