Merge branch 'for-linus2' of git://git.kernel.dk/linux-2.6-block

* 'for-linus2' of git://git.kernel.dk/linux-2.6-block:
  pipe: fix check in "set size" fcntl
  pipe: fix pipe buffer resizing
  block: remove duplicate BUG_ON() in bd_finish_claiming()
  block: bd_start_claiming cleanup
  block: bd_start_claiming fix module refcount

1 files changed, 14 insertions, 6 deletions

diff --git a/fs/pipe.c b/fs/pipe.c
index 69c4c7c13ea9..279eef96c51c 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1145,13 +1145,20 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
          * and adjust the indexes.
          */
         if (pipe->nrbufs) {
-                const unsigned int tail = pipe->nrbufs & (pipe->buffers - 1);
-                const unsigned int head = pipe->nrbufs - tail;
+                unsigned int tail;
+                unsigned int head;
 
+                tail = pipe->curbuf + pipe->nrbufs;
+                if (tail < pipe->buffers)
+                        tail = 0;
+                else
+                        tail &= (pipe->buffers - 1);
+
+                head = pipe->nrbufs - tail;
                 if (head)
                         memcpy(bufs, pipe->bufs + pipe->curbuf, head * sizeof(struct pipe_buffer));
                 if (tail)
-                        memcpy(bufs + head, pipe->bufs + pipe->curbuf, tail * sizeof(struct pipe_buffer));
+                        memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
         }
 
         pipe->curbuf = 0;
@@ -1208,12 +1215,13 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
                 size = round_pipe_size(arg);
                 nr_pages = size >> PAGE_SHIFT;
 
+                ret = -EINVAL;
+                if (!nr_pages)
+                        goto out;
+
                 if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
                         ret = -EPERM;
                         goto out;
-                } else if (nr_pages < PAGE_SIZE) {
-                        ret = -EINVAL;
-                        goto out;
                 }
                 ret = pipe_set_size(pipe, nr_pages);
                 break;