1 files changed, 36 insertions, 5 deletions

diff --git a/fs/pipe.c b/fs/pipe.c
index e2f4f1d9ffc2..109a102c150d 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -15,6 +15,7 @@
 #include <linux/pipe_fs_i.h>
 #include <linux/uio.h>
 #include <linux/highmem.h>
+#include <linux/pagemap.h>
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -94,11 +95,20 @@ static void anon_pipe_buf_release(struct pipe_inode_info *info, struct pipe_buff
 {
         struct page *page = buf->page;
 
-        if (info->tmp_page) {
-                __free_page(page);
+        /*
+         * If nobody else uses this page, and we don't already have a
+         * temporary page, let's keep track of it as a one-deep
+         * allocation cache
+         */
+        if (page_count(page) == 1 && !info->tmp_page) {
+                info->tmp_page = page;
                 return;
         }
-        info->tmp_page = page;
+
+        /*
+         * Otherwise just release our reference to it
+         */
+        page_cache_release(page);
 }
 
 static void *anon_pipe_buf_map(struct file *file, struct pipe_inode_info *info, struct pipe_buffer *buf)
@@ -111,11 +121,19 @@ static void anon_pipe_buf_unmap(struct pipe_inode_info *info, struct pipe_buffer
         kunmap(buf->page);
 }
 
+static int anon_pipe_buf_steal(struct pipe_inode_info *info,
+                               struct pipe_buffer *buf)
+{
+        buf->stolen = 1;
+        return 0;
+}
+
 static struct pipe_buf_operations anon_pipe_buf_ops = {
         .can_merge = 1,
         .map = anon_pipe_buf_map,
         .unmap = anon_pipe_buf_unmap,
         .release = anon_pipe_buf_release,
+        .steal = anon_pipe_buf_steal,
 };
 
 static ssize_t
@@ -152,6 +170,11 @@ pipe_readv(struct file *filp, const struct iovec *_iov,
                                 chars = total_len;
 
                         addr = ops->map(filp, info, buf);
+                        if (IS_ERR(addr)) {
+                                if (!ret)
+                                        ret = PTR_ERR(addr);
+                                break;
+                        }
                         error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars);
                         ops->unmap(info, buf);
                         if (unlikely(error)) {
@@ -254,8 +277,16 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
                 struct pipe_buf_operations *ops = buf->ops;
                 int offset = buf->offset + buf->len;
                 if (ops->can_merge && offset + chars <= PAGE_SIZE) {
-                        void *addr = ops->map(filp, info, buf);
-                        int error = pipe_iov_copy_from_user(offset + addr, iov, chars);
+                        void *addr;
+                        int error;
+
+                        addr = ops->map(filp, info, buf);
+                        if (IS_ERR(addr)) {
+                                error = PTR_ERR(addr);
+                                goto out;
+                        }
+                        error = pipe_iov_copy_from_user(offset + addr, iov,
+                                                        chars);
                         ops->unmap(info, buf);
                         ret = error;
                         do_wakeup = 1;