Commit 06ae43f3 authored by Al Viro's avatar Al Viro
Browse files

Don't bother with redoing rw_verify_area() from default_file_splice_from()

default_file_splice_from() ends up calling vfs_write() (via very convoluted
callchain).  It's an overkill, since we already have done rw_verify_area()
in the caller by the time we call vfs_write() we are under set_fs(KERNEL_DS),
so access_ok() is also pointless.  Add a new helper (__kernel_write()),
use it instead of kernel_write() in there.
Signed-off-by: default avatarAl Viro <>
parent f6161aa1
......@@ -125,3 +125,8 @@ extern int invalidate_inodes(struct super_block *, bool);
* dcache.c
extern struct dentry *__d_alloc(struct super_block *, const struct qstr *);
* read_write.c
extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
......@@ -17,6 +17,7 @@
#include <linux/splice.h>
#include <linux/compat.h>
#include "read_write.h"
#include "internal.h"
#include <asm/uaccess.h>
#include <asm/unistd.h>
......@@ -417,6 +418,30 @@ ssize_t do_sync_write(struct file *filp, const char __user *buf, size_t len, lof
ssize_t __kernel_write(struct file *file, const char *buf, size_t count, loff_t *pos)
mm_segment_t old_fs;
const char __user *p;
ssize_t ret;
old_fs = get_fs();
p = (__force const char __user *)buf;
if (count > MAX_RW_COUNT)
count = MAX_RW_COUNT;
if (file->f_op->write)
ret = file->f_op->write(file, p, count, pos);
ret = do_sync_write(file, p, count, pos);
if (ret > 0) {
add_wchar(current, ret);
return ret;
ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_t *pos)
ssize_t ret;
......@@ -31,6 +31,7 @@
#include <linux/security.h>
#include <linux/gfp.h>
#include <linux/socket.h>
#include "internal.h"
* Attempt to steal a page from a pipe buffer. This should perhaps go into
......@@ -1048,9 +1049,10 @@ static int write_pipe_buf(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
int ret;
void *data;
loff_t tmp = sd->pos;
data = buf->ops->map(pipe, buf, 0);
ret = kernel_write(sd->u.file, data + buf->offset, sd->len, sd->pos);
ret = __kernel_write(sd->u.file, data + buf->offset, sd->len, &tmp);
buf->ops->unmap(pipe, buf, data);
return ret;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment