fix memory leaks in tracing_buffers_splice_read()

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8fb4847..77eeab2 100644 (file)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5930,9 +5930,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                return -EBUSY;
 #endif
 
                return -EBUSY;
 #endif
 

-       if (splice_grow_spd(pipe, &spd))
-               return -ENOMEM;
-

        if (*ppos & (PAGE_SIZE - 1))
                return -EINVAL;
 
        if (*ppos & (PAGE_SIZE - 1))
                return -EINVAL;
 


@@ -5942,6 +5939,9 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                len &= PAGE_MASK;
        }
 
                len &= PAGE_MASK;
        }
 

+       if (splice_grow_spd(pipe, &spd))
+               return -ENOMEM;
+

  again:
        trace_access_lock(iter->cpu_file);
        entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file);
  again:
        trace_access_lock(iter->cpu_file);
        entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file);


@@ -5999,19 +5999,21 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
        /* did we read anything? */
        if (!spd.nr_pages) {
                if (ret)
        /* did we read anything? */
        if (!spd.nr_pages) {
                if (ret)

-                       return ret;
+                       goto out;

 
 

+               ret = -EAGAIN;

                if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK))
                if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK))

-                       return -EAGAIN;
+                       goto out;

 
                ret = wait_on_pipe(iter, true);
                if (ret)
 
                ret = wait_on_pipe(iter, true);
                if (ret)

-                       return ret;
+                       goto out;

 
                goto again;
        }
 
        ret = splice_to_pipe(pipe, &spd);
 
                goto again;
        }
 
        ret = splice_to_pipe(pipe, &spd);

+out:

        splice_shrink_spd(&spd);
 
        return ret;
        splice_shrink_spd(&spd);
 
        return ret;