do_splice_to(): cap the size before passing to ->splice_read()

pipe capacity won't exceed 2G anyway.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 3 insertions, 0 deletions

diff --git a/fs/splice.c b/fs/splice.c
index 9947b5c69664..a6b87b7e0745 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1143,6 +1143,9 @@ static long do_splice_to(struct file *in, loff_t *ppos,
         if (unlikely(ret < 0))
                 return ret;
 
+        if (unlikely(len > MAX_RW_COUNT))
+                len = MAX_RW_COUNT;
+
         if (in->f_op->splice_read)
                 splice_read = in->f_op->splice_read;
         else