missing bits of "splice: fix racy pipe->buffers uses"

that commit has fixed only the parts of that mess in fs/splice.c itself;
there had been more in several other ->splice_read() instances...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 1 insertions, 1 deletions

diff --git a/kernel/relay.c b/kernel/relay.c
index 98833f664fb6..7d38607649a3 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1251,7 +1251,7 @@ static ssize_t subbuf_splice_actor(struct file *in,
         subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
         pidx = (read_start / PAGE_SIZE) % subbuf_pages;
         poff = read_start & ~PAGE_MASK;
-        nr_pages = min_t(unsigned int, subbuf_pages, pipe->buffers);
+        nr_pages = min_t(unsigned int, subbuf_pages, spd.nr_pages_max);
 
         for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
                 unsigned int this_len, this_end, private;