relayfs: fix infinite loop with splice()

[linux-2.6-omap-h63xx.git] / kernel / relay.c

diff --git a/kernel/relay.c b/kernel/relay.c
index 04006ef970b818b01d6cb152c5a5997896a06478..09ac2008f77b419a5c169e41f3ddcbab6aa90746 100644 (file)
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -400,7 +400,7 @@ void relay_reset(struct rchan *chan)
        }
 
        mutex_lock(&relay_channels_mutex);
-       for_each_online_cpu(i)
+       for_each_possible_cpu(i)
                if (chan->buf[i])
                        __relay_reset(chan->buf[i], 0);
        mutex_unlock(&relay_channels_mutex);
@@ -611,10 +611,9 @@ struct rchan *relay_open(const char *base_filename,
        return chan;
 
 free_bufs:
-       for_each_online_cpu(i) {
-               if (!chan->buf[i])
-                       break;
-               relay_close_buf(chan->buf[i]);
+       for_each_possible_cpu(i) {
+               if (chan->buf[i])
+                       relay_close_buf(chan->buf[i]);
        }
 
        kref_put(&chan->kref, relay_destroy_channel);
@@ -944,6 +943,10 @@ static void relay_file_read_consume(struct rchan_buf *buf,
        size_t n_subbufs = buf->chan->n_subbufs;
        size_t read_subbuf;
 
+       if (buf->subbufs_produced == buf->subbufs_consumed &&
+           buf->offset == buf->bytes_consumed)
+               return;
+
        if (buf->bytes_consumed + bytes_consumed > subbuf_size) {
                relay_subbufs_consumed(buf->chan, buf->cpu, 1);
                buf->bytes_consumed = 0;
@@ -975,6 +978,8 @@ static int relay_file_read_avail(struct rchan_buf *buf, size_t read_pos)
 
        relay_file_read_consume(buf, read_pos, 0);
 
+       consumed = buf->subbufs_consumed;
+
        if (unlikely(buf->offset > subbuf_size)) {
                if (produced == consumed)
                        return 0;
@@ -993,8 +998,12 @@ static int relay_file_read_avail(struct rchan_buf *buf, size_t read_pos)
        if (consumed > produced)
                produced += n_subbufs * subbuf_size;
 
-       if (consumed == produced)
+       if (consumed == produced) {
+               if (buf->offset == subbuf_size &&
+                   buf->subbufs_produced > buf->subbufs_consumed)
+                       return 1;
                return 0;
+       }
 
        return 1;
 }
@@ -1308,12 +1317,9 @@ static ssize_t relay_file_splice_read(struct file *in,
                if (ret < 0)
                        break;
                else if (!ret) {
-                       if (spliced)
-                               break;
-                       if (flags & SPLICE_F_NONBLOCK) {
+                       if (flags & SPLICE_F_NONBLOCK)
                                ret = -EAGAIN;
-                               break;
-                       }
+                       break;
                }
 
                *ppos += ret;