Commit 732c4a9e authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Pull fuse fixes from Miklos Szeredi:
 "Two bugfixes, both bound for -stable"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: break infinite loop in fuse_fill_write_pages()
  cuse: fix memory leak
parents 4be460d9 3ca8138f
...@@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file) ...@@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file)
unregister_chrdev_region(cc->cdev->dev, 1); unregister_chrdev_region(cc->cdev->dev, 1);
cdev_del(cc->cdev); cdev_del(cc->cdev);
} }
/* Base reference is now owned by "fud" */
fuse_conn_put(&cc->fc);
rc = fuse_dev_release(inode, file); /* puts the base reference */ rc = fuse_dev_release(inode, file); /* puts the base reference */
......
...@@ -1049,6 +1049,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, ...@@ -1049,6 +1049,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes); tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
flush_dcache_page(page); flush_dcache_page(page);
iov_iter_advance(ii, tmp);
if (!tmp) { if (!tmp) {
unlock_page(page); unlock_page(page);
page_cache_release(page); page_cache_release(page);
...@@ -1061,7 +1062,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req, ...@@ -1061,7 +1062,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
req->page_descs[req->num_pages].length = tmp; req->page_descs[req->num_pages].length = tmp;
req->num_pages++; req->num_pages++;
iov_iter_advance(ii, tmp);
count += tmp; count += tmp;
pos += tmp; pos += tmp;
offset += tmp; offset += tmp;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment