Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block

* 'for-linus' of git://git.kernel.dk/linux-2.6-block: (37 commits)
  splice: fix generic_file_splice_read() race with page invalidation
  ramfs: enable splice write
  drivers/block/pktcdvd.c: avoid useless memset
  cdrom: revert commit 22a9189 (cdrom: use kmalloced buffers instead of buffers on stack)
  scsi: sr avoids useless buffer allocation
  block: blk_rq_map_kern uses the bounce buffers for stack buffers
  block: add blk_queue_update_dma_pad
  DAC960: push down BKL
  pktcdvd: push BKL down into driver
  paride: push ioctl down into driver
  block: use get_unaligned_* helpers
  block: extend queue_flag bitops
  block: request_module(): use format string
  Add bvec_merge_data to handle stacked devices and ->merge_bvec()
  block: integrity flags can't use bit ops on unsigned short
  cmdfilter: extend default read filter
  sg: fix odd style (extra parenthesis) introduced by cmd filter patch
  block: add bounce support to blk_rq_map_user_iov
  cfq-iosched: get rid of enable_idle being unused warning
  allow userspace to modify scsi command filter on per device basis
  ...

1 files changed, 13 insertions, 4 deletions

diff --git a/fs/splice.c b/fs/splice.c
index aa5f6f60b305..399442179d89 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -379,13 +379,22 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                                 lock_page(page);
 
                         /*
-                         * page was truncated, stop here. if this isn't the
-                         * first page, we'll just complete what we already
-                         * added
+                         * Page was truncated, or invalidated by the
+                         * filesystem.  Redo the find/create, but this time the
+                         * page is kept locked, so there's no chance of another
+                         * race with truncate/invalidate.
                          */
                         if (!page->mapping) {
                                 unlock_page(page);
-                                break;
+                                page = find_or_create_page(mapping, index,
+                                                mapping_gfp_mask(mapping));
+
+                                if (!page) {
+                                        error = -ENOMEM;
+                                        break;
+                                }
+                                page_cache_release(pages[page_nr]);
+                                pages[page_nr] = page;
                         }
                         /*
                          * page was already under io and is now done, great