X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=fs%2Fsplice.c;h=de2ede048473cef81bec9161cf1842b70835ea63;hb=6a0141a0966cfbd765bff065c3eb61b09a92318e;hp=3553f1956508daeca04aa1acaa1aaab61cdbb6e5;hpb=97b6f89f7269b746b68e7985c16d2354c688d29a;p=mirror_ubuntu-hirsute-kernel.git

diff --git a/fs/splice.c b/fs/splice.c
index 3553f1956508..de2ede048473 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -945,11 +945,16 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
 	sd->flags &= ~SPLICE_F_NONBLOCK;
 	more = sd->flags & SPLICE_F_MORE;
 
+	WARN_ON_ONCE(pipe->nrbufs != 0);
+
 	while (len) {
 		size_t read_len;
 		loff_t pos = sd->pos, prev_pos = pos;
 
-		ret = do_splice_to(in, &pos, pipe, len, flags);
+		/* Don't try to read more the pipe has space for. */
+		read_len = min_t(size_t, len,
+				 (pipe->buffers - pipe->nrbufs) << PAGE_SHIFT);
+		ret = do_splice_to(in, &pos, pipe, read_len, flags);
 		if (unlikely(ret <= 0))
 			goto out_release;