1 files changed, 10 insertions, 5 deletions

diff --git a/kernel/relay.c b/kernel/relay.c
index 3d97f2821611..4268287148c1 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1231,8 +1231,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
         size_t read_subbuf = read_start / subbuf_size;
         size_t padding = rbuf->padding[read_subbuf];
         size_t nonpad_end = read_subbuf * subbuf_size + subbuf_size - padding;
-        struct page *pages[PIPE_BUFFERS];
-        struct partial_page partial[PIPE_BUFFERS];
+        struct page *pages[PIPE_DEF_BUFFERS];
+        struct partial_page partial[PIPE_DEF_BUFFERS];
         struct splice_pipe_desc spd = {
                 .pages = pages,
                 .nr_pages = 0,
@@ -1245,6 +1245,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
 
         if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
                 return 0;
+        if (splice_grow_spd(pipe, &spd))
+                return -ENOMEM;
 
         /*
          * Adjust read len, if longer than what is available
@@ -1255,7 +1257,7 @@ static ssize_t subbuf_splice_actor(struct file *in,
         subbuf_pages = rbuf->chan->alloc_size >> PAGE_SHIFT;
         pidx = (read_start / PAGE_SIZE) % subbuf_pages;
         poff = read_start & ~PAGE_MASK;
-        nr_pages = min_t(unsigned int, subbuf_pages, PIPE_BUFFERS);
+        nr_pages = min_t(unsigned int, subbuf_pages, pipe->buffers);
 
         for (total_len = 0; spd.nr_pages < nr_pages; spd.nr_pages++) {
                 unsigned int this_len, this_end, private;
@@ -1289,16 +1291,19 @@ static ssize_t subbuf_splice_actor(struct file *in,
                 }
         }
 
+        ret = 0;
         if (!spd.nr_pages)
-                return 0;
+                goto out;
 
         ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
         if (ret < 0 || ret < total_len)
-                return ret;
+                goto out;
 
         if (read_start + ret == nonpad_end)
                 ret += padding;
 
+out:
+        splice_shrink_spd(pipe, &spd);
         return ret;
 }