[PATCH] splice: fix bugs in pipe_to_file()
[safe/jmp/linux-2.6] / fs / splice.c
index 447ebc0..1633778 100644 (file)
@@ -78,7 +78,7 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *info,
                return 1;
        }
 
-       buf->flags |= PIPE_BUF_FLAG_STOLEN | PIPE_BUF_FLAG_LRU;
+       buf->flags |= PIPE_BUF_FLAG_LRU;
        return 0;
 }
 
@@ -87,7 +87,7 @@ static void page_cache_pipe_buf_release(struct pipe_inode_info *info,
 {
        page_cache_release(buf->page);
        buf->page = NULL;
-       buf->flags &= ~(PIPE_BUF_FLAG_STOLEN | PIPE_BUF_FLAG_LRU);
+       buf->flags &= ~PIPE_BUF_FLAG_LRU;
 }
 
 static void *page_cache_pipe_buf_map(struct file *file,
@@ -279,7 +279,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
        pgoff_t index, end_index;
        loff_t isize;
        size_t total_len;
-       int error;
+       int error, page_nr;
        struct splice_pipe_desc spd = {
                .pages = pages,
                .partial = partial,
@@ -299,47 +299,75 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
         * read-ahead if this is a non-zero offset (we are likely doing small
         * chunk splice and the page is already there) for a single page.
         */
-       if (!loff || spd.nr_pages > 1)
-               do_page_cache_readahead(mapping, in, index, spd.nr_pages);
+       if (!loff || nr_pages > 1)
+               page_cache_readahead(mapping, &in->f_ra, in, index, nr_pages);
 
        /*
         * Now fill in the holes:
         */
        error = 0;
        total_len = 0;
-       for (spd.nr_pages = 0; spd.nr_pages < nr_pages; spd.nr_pages++, index++) {
-               unsigned int this_len;
 
-               if (!len)
-                       break;
+       /*
+        * Lookup the (hopefully) full range of pages we need.
+        */
+       spd.nr_pages = find_get_pages_contig(mapping, index, nr_pages, pages);
 
+       /*
+        * If find_get_pages_contig() returned fewer pages than we needed,
+        * allocate the rest.
+        */
+       index += spd.nr_pages;
+       while (spd.nr_pages < nr_pages) {
                /*
-                * this_len is the max we'll use from this page
-                */
-               this_len = min_t(unsigned long, len, PAGE_CACHE_SIZE - loff);
-find_page:
-               /*
-                * lookup the page for this index
+                * Page could be there, find_get_pages_contig() breaks on
+                * the first hole.
                 */
                page = find_get_page(mapping, index);
                if (!page) {
                        /*
-                        * page didn't exist, allocate one
+                        * page didn't exist, allocate one.
                         */
                        page = page_cache_alloc_cold(mapping);
                        if (!page)
                                break;
 
                        error = add_to_page_cache_lru(page, mapping, index,
-                                               mapping_gfp_mask(mapping));
+                                             mapping_gfp_mask(mapping));
                        if (unlikely(error)) {
                                page_cache_release(page);
                                break;
                        }
-
-                       goto readpage;
+                       /*
+                        * add_to_page_cache() locks the page, unlock it
+                        * to avoid convoluting the logic below even more.
+                        */
+                       unlock_page(page);
                }
 
+               pages[spd.nr_pages++] = page;
+               index++;
+       }
+
+       /*
+        * Now loop over the map and see if we need to start IO on any
+        * pages, fill in the partial map, etc.
+        */
+       index = *ppos >> PAGE_CACHE_SHIFT;
+       nr_pages = spd.nr_pages;
+       spd.nr_pages = 0;
+       for (page_nr = 0; page_nr < nr_pages; page_nr++) {
+               unsigned int this_len;
+
+               if (!len)
+                       break;
+
+               /*
+                * this_len is the max we'll use from this page
+                */
+               this_len = min_t(unsigned long, len, PAGE_CACHE_SIZE - loff);
+               page = pages[page_nr];
+
                /*
                 * If the page isn't uptodate, we may need to start io on it
                 */
@@ -360,7 +388,6 @@ find_page:
                         */
                        if (!page->mapping) {
                                unlock_page(page);
-                               page_cache_release(page);
                                break;
                        }
                        /*
@@ -371,16 +398,20 @@ find_page:
                                goto fill_it;
                        }
 
-readpage:
                        /*
                         * need to read in the page
                         */
                        error = mapping->a_ops->readpage(in, page);
-
                        if (unlikely(error)) {
-                               page_cache_release(page);
+                               /*
+                                * We really should re-lookup the page here,
+                                * but it complicates things a lot. Instead
+                                * lets just do what we already stored, and
+                                * we'll get it the next time we are called.
+                                */
                                if (error == AOP_TRUNCATED_PAGE)
-                                       goto find_page;
+                                       error = 0;
+
                                break;
                        }
 
@@ -389,10 +420,8 @@ readpage:
                         */
                        isize = i_size_read(mapping->host);
                        end_index = (isize - 1) >> PAGE_CACHE_SHIFT;
-                       if (unlikely(!isize || index > end_index)) {
-                               page_cache_release(page);
+                       if (unlikely(!isize || index > end_index))
                                break;
-                       }
 
                        /*
                         * if this is the last page, see if we need to shrink
@@ -400,27 +429,33 @@ readpage:
                         */
                        if (end_index == index) {
                                loff = PAGE_CACHE_SIZE - (isize & ~PAGE_CACHE_MASK);
-                               if (total_len + loff > isize) {
-                                       page_cache_release(page);
+                               if (total_len + loff > isize)
                                        break;
-                               }
                                /*
                                 * force quit after adding this page
                                 */
-                               nr_pages = spd.nr_pages;
+                               len = this_len;
                                this_len = min(this_len, loff);
                                loff = 0;
                        }
                }
 fill_it:
-               pages[spd.nr_pages] = page;
-               partial[spd.nr_pages].offset = loff;
-               partial[spd.nr_pages].len = this_len;
+               partial[page_nr].offset = loff;
+               partial[page_nr].len = this_len;
                len -= this_len;
                total_len += this_len;
                loff = 0;
+               spd.nr_pages++;
+               index++;
        }
 
+       /*
+        * Release any pages at the end, if we quit early. 'i' is how far
+        * we got, 'nr_pages' is how many pages are in the map.
+        */
+       while (page_nr < nr_pages)
+               page_cache_release(pages[page_nr++]);
+
        if (spd.nr_pages)
                return splice_to_pipe(pipe, &spd);
 
@@ -552,9 +587,10 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
                this_len = PAGE_CACHE_SIZE - offset;
 
        /*
-        * Reuse buf page, if SPLICE_F_MOVE is set.
+        * Reuse buf page, if SPLICE_F_MOVE is set and we are doing a full
+        * page.
         */
-       if (sd->flags & SPLICE_F_MOVE) {
+       if ((sd->flags & SPLICE_F_MOVE) && this_len == PAGE_CACHE_SIZE) {
                /*
                 * If steal succeeds, buf->page is now pruned from the vm
                 * side (LRU and page cache) and we can reuse it. The page
@@ -564,8 +600,12 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
                        goto find_page;
 
                page = buf->page;
-               if (add_to_page_cache(page, mapping, index, gfp_mask))
+               if (add_to_page_cache(page, mapping, index, gfp_mask)) {
+                       unlock_page(page);
                        goto find_page;
+               }
+
+               page_cache_get(page);
 
                if (!(buf->flags & PIPE_BUF_FLAG_LRU))
                        lru_cache_add(page);
@@ -625,7 +665,7 @@ find_page:
        } else if (ret)
                goto out;
 
-       if (!(buf->flags & PIPE_BUF_FLAG_STOLEN)) {
+       if (buf->page != page) {
                char *dst = kmap_atomic(page, KM_USER0);
 
                memcpy(dst + offset, src + buf->offset, this_len);
@@ -634,22 +674,20 @@ find_page:
        }
 
        ret = mapping->a_ops->commit_write(file, page, offset, offset+this_len);
-       if (ret == AOP_TRUNCATED_PAGE) {
+       if (!ret) {
+               /*
+                * Return the number of bytes written and mark page as
+                * accessed, we are now done!
+                */
+               ret = this_len;
+               mark_page_accessed(page);
+               balance_dirty_pages_ratelimited(mapping);
+       } else if (ret == AOP_TRUNCATED_PAGE) {
                page_cache_release(page);
                goto find_page;
-       } else if (ret)
-               goto out;
-
-       /*
-        * Return the number of bytes written.
-        */
-       ret = this_len;
-       mark_page_accessed(page);
-       balance_dirty_pages_ratelimited(mapping);
+       }
 out:
-       if (!(buf->flags & PIPE_BUF_FLAG_STOLEN))
-               page_cache_release(page);
-
+       page_cache_release(page);
        unlock_page(page);
 out_nomem:
        buf->ops->unmap(info, buf);