1 files changed, 16 insertions, 9 deletions

diff --git a/fs/splice.c b/fs/splice.c
index 7394e9e17534..9313b6124a2e 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -30,6 +30,7 @@
 #include <linux/syscalls.h>
 #include <linux/uio.h>
 #include <linux/security.h>
+#include <linux/gfp.h>
 
 /*
  * Attempt to steal a page from a pipe buffer. This should perhaps go into
@@ -648,9 +649,11 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
         ret = buf->ops->confirm(pipe, buf);
         if (!ret) {
                 more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
-
-                ret = file->f_op->sendpage(file, buf->page, buf->offset,
-                                           sd->len, &pos, more);
+                if (file->f_op && file->f_op->sendpage)
+                        ret = file->f_op->sendpage(file, buf->page, buf->offset,
+                                                   sd->len, &pos, more);
+                else
+                        ret = -EINVAL;
         }
 
         return ret;
@@ -1068,8 +1071,9 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
         if (unlikely(ret < 0))
                 return ret;
 
-        splice_write = out->f_op->splice_write;
-        if (!splice_write)
+        if (out->f_op && out->f_op->splice_write)
+                splice_write = out->f_op->splice_write;
+        else
                 splice_write = default_file_splice_write;
 
         return splice_write(pipe, out, ppos, len, flags);
@@ -1093,8 +1097,9 @@ static long do_splice_to(struct file *in, loff_t *ppos,
         if (unlikely(ret < 0))
                 return ret;
 
-        splice_read = in->f_op->splice_read;
-        if (!splice_read)
+        if (in->f_op && in->f_op->splice_read)
+                splice_read = in->f_op->splice_read;
+        else
                 splice_read = default_file_splice_read;
 
         return splice_read(in, ppos, pipe, len, flags);
@@ -1316,7 +1321,8 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                 if (off_in)
                         return -ESPIPE;
                 if (off_out) {
-                        if (out->f_op->llseek == no_llseek)
+                        if (!out->f_op || !out->f_op->llseek ||
+                            out->f_op->llseek == no_llseek)
                                 return -EINVAL;
                         if (copy_from_user(&offset, off_out, sizeof(loff_t)))
                                 return -EFAULT;
@@ -1336,7 +1342,8 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                 if (off_out)
                         return -ESPIPE;
                 if (off_in) {
-                        if (in->f_op->llseek == no_llseek)
+                        if (!in->f_op || !in->f_op->llseek ||
+                            in->f_op->llseek == no_llseek)
                                 return -EINVAL;
                         if (copy_from_user(&offset, off_in, sizeof(loff_t)))
                                 return -EFAULT;