Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull second set of VFS changes from Al Viro:
 "Assorted f_pos race fixes, making do_splice_direct() safe to call with
  i_mutex on parent, O_TMPFILE support, Jeff's locks.c series,
  ->d_hash/->d_compare calling conventions changes from Linus, misc
  stuff all over the place."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
  Document ->tmpfile()
  ext4: ->tmpfile() support
  vfs: export lseek_execute() to modules
  lseek_execute() doesn't need an inode passed to it
  block_dev: switch to fixed_size_llseek()
  cpqphp_sysfs: switch to fixed_size_llseek()
  tile-srom: switch to fixed_size_llseek()
  proc_powerpc: switch to fixed_size_llseek()
  ubi/cdev: switch to fixed_size_llseek()
  pci/proc: switch to fixed_size_llseek()
  isapnp: switch to fixed_size_llseek()
  lpfc: switch to fixed_size_llseek()
  locks: give the blocked_hash its own spinlock
  locks: add a new "lm_owner_key" lock operation
  locks: turn the blocked_list into a hashtable
  locks: convert fl_link to a hlist_node
  locks: avoid taking global lock if possible when waking up blocked waiters
  locks: protect most of the file_lock handling with i_lock
  locks: encapsulate the fl_link list handling
  locks: make "added" in __posix_lock_file a bool
  ...

1 files changed, 23 insertions, 15 deletions

diff --git a/fs/splice.c b/fs/splice.c
index d37431dd60a1..3b7ee656f3aa 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1098,27 +1098,13 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
 {
         ssize_t (*splice_write)(struct pipe_inode_info *, struct file *,
                                 loff_t *, size_t, unsigned int);
-        int ret;
-
-        if (unlikely(!(out->f_mode & FMODE_WRITE)))
-                return -EBADF;
-
-        if (unlikely(out->f_flags & O_APPEND))
-                return -EINVAL;
-
-        ret = rw_verify_area(WRITE, out, ppos, len);
-        if (unlikely(ret < 0))
-                return ret;
 
         if (out->f_op && out->f_op->splice_write)
                 splice_write = out->f_op->splice_write;
         else
                 splice_write = default_file_splice_write;
 
-        file_start_write(out);
-        ret = splice_write(pipe, out, ppos, len, flags);
-        file_end_write(out);
-        return ret;
+        return splice_write(pipe, out, ppos, len, flags);
 }
 
 /*
@@ -1307,6 +1293,16 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
         };
         long ret;
 
+        if (unlikely(!(out->f_mode & FMODE_WRITE)))
+                return -EBADF;
+
+        if (unlikely(out->f_flags & O_APPEND))
+                return -EINVAL;
+
+        ret = rw_verify_area(WRITE, out, opos, len);
+        if (unlikely(ret < 0))
+                return ret;
+
         ret = splice_direct_to_actor(in, &sd, direct_splice_actor);
         if (ret > 0)
                 *ppos = sd.pos;
@@ -1362,7 +1358,19 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                         offset = out->f_pos;
                 }
 
+                if (unlikely(!(out->f_mode & FMODE_WRITE)))
+                        return -EBADF;
+
+                if (unlikely(out->f_flags & O_APPEND))
+                        return -EINVAL;
+
+                ret = rw_verify_area(WRITE, out, &offset, len);
+                if (unlikely(ret < 0))
+                        return ret;
+
+                file_start_write(out);
                 ret = do_splice_from(ipipe, out, &offset, len, flags);
+                file_end_write(out);
 
                 if (!off_out)
                         out->f_pos = offset;