Found by Oleg Nesterov <oleg@tv-sign.ru>, fixed by me.

- Only allow full pages to go to the page cache.
- Check page != buf->page instead of using PIPE_BUF_FLAG_STOLEN.
- Remember to clear 'stolen' if add_to_page_cache() fails.

And as a cleanup on that:

- Make the bottom fall-through logic a little less convoluted. Also make
  the steal path hold an extra reference to the page, so we don't have
  to differentiate between stolen and non-stolen at the end.
Signed-off-by: NJens Axboe <axboe@suse.de>

- Check that page has suitable count for stealing in the regular pipes.
- pipe_to_file() assumes that the page is locked on succesful steal, so
  do that in the pipe steal hook
- Missing unlock_page() in add_to_page_cache() failure.
Signed-off-by: NJens Axboe <axboe@suse.de>

Use the new find_get_pages_contig() to potentially look up the entire
splice range in one single call. This speeds up generic_file_splice_read()
quite a bit.
Signed-off-by: NJens Axboe <axboe@suse.de>

Avoids doing useless work, when the file is fully cached.
Signed-off-by: NJens Axboe <axboe@suse.de>

We need these for people writing their own ->splice_read/write hooks.
Signed-off-by: NJens Axboe <axboe@suse.de>

sys_splice() moves data to/from pipes with a file input/output. sys_vmsplice()
moves data to a pipe, with the input being a user address range instead.

This uses an approach suggested by Linus, where we can hold partial ranges
inside the pages[] map. Hopefully this will be useful for network
receive support as well.
Signed-off-by: NJens Axboe <axboe@suse.de>

Make the move_from_pipe() actors return number of bytes processed, then
move_from_pipe() can decide more cleverly when to move on to the next
buffer.

This fixes problems with pipe offset and differing file offset.
Signed-off-by: NJens Axboe <axboe@suse.de>

Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJens Axboe <axboe@suse.de>

Signed-off-by: NJens Axboe <axboe@suse.de>

Since ->map() no longer locks the page, we need to adjust the handling
of those pages (and stealing) a little. This now passes full regressions
again.
Signed-off-by: NJens Axboe <axboe@suse.de>

- We need to adjust *ppos for writes as well.
- Copy back modified offset value if one was passed in, similar to
  what sendfile does.
Signed-off-by: NJens Axboe <axboe@suse.de>

We need to ensure that we only drop a lock that is ordered last, to avoid
ABBA deadlocks with competing processes.
Signed-off-by: NJens Axboe <axboe@suse.de>

- generic_file_splice_read() more readable and correct
- Don't bail on page allocation with NONBLOCK set, just don't allow
  direct blocking on IO (eg lock_page).
Signed-off-by: NJens Axboe <axboe@suse.de>

We need to check i_size after doing a blocking readpage.
Signed-off-by: NJens Axboe <axboe@suse.de>

Basically an in-kernel implementation of tee, which uses splice and the
pipe buffers as an intelligent way to pass data around by reference.

Where the user space tee consumes the input and produces a stdout and
file output, this syscall merely duplicates the data inside a pipe to
another pipe. No data is copied, the output just grabs a reference to the
input pipe data.
Signed-off-by: NJens Axboe <axboe@suse.de>

We need not use ->f_pos as the offset for the file input/output. If the
user passed an offset pointer in through sys_splice(), just use that and
leave ->f_pos alone.
Signed-off-by: NJens Axboe <axboe@suse.de>

 - capitalize consistently
 - end sentences in one way or another
 - update comment text to match the implementation
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NJens Axboe <axboe@suse.de>

The comment is also somewhat out of date, correct that as well.
Signed-off-by: NJens Axboe <axboe@suse.de>

Also corrects a few comments. Patch mainly from Ingo, changes by me.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NJens Axboe <axboe@suse.de>

- Kill the local variables that cache ->nrbufs, they just take up space.

- Only set do_wakeup for a real pipe. This is a big win for direct splicing.

- Kill i_mutex lock around ->f_pos update, regular io paths don't do this
  either.
Signed-off-by: NJens Axboe <axboe@suse.de>

Using find_get_page() is a lot faster than find_or_create_page(). This
gets splice a lot closer to sendfile() for fd -> socket transfers.
Signed-off-by: NJens Axboe <axboe@suse.de>

It's more efficient for sendfile() emulation. Basically we cache an
internal private pipe and just use that as the intermediate area for
pages. Direct splicing is not available from sys_splice(), it is only
meant to be used for sendfile() emulation.

Additional patch from Ingo Molnar to avoid the PIPE_BUFFERS loop at
exit for the normal fast path.
Signed-off-by: NJens Axboe <axboe@suse.de>

add optional input and output offsets to sys_splice(), for seekable file
descriptors:

 asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
                            int fd_out, loff_t __user *off_out,
                            size_t len, unsigned int flags);

semantics are straightforward: f_pos will be updated with the offset
provided by user-space, before the splice transfer is about to begin.
Providing a NULL offset pointer means the existing f_pos will be used
(and updated in situ).  Providing an offset for a pipe results in
-ESPIPE. Providing an invalid offset pointer results in -EFAULT.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NJens Axboe <axboe@suse.de>

separate out the 'internal pipe object' abstraction, and make it
usable to splice. This cleans up and fixes several aspects of the
internal splice APIs and the pipe code:

 - pipes: the allocation and freeing of pipe_inode_info is now more symmetric
   and more streamlined with existing kernel practices.

 - splice: small micro-optimization: less pointer dereferencing in splice
   methods
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Update XFS for the ->splice_read/->splice_write changes.
Signed-off-by: NJens Axboe <axboe@suse.de>

We don't want to call into the read-ahead logic unless we are at the
start of a page, _or_ we have multiple pages to read.
Signed-off-by: NJens Axboe <axboe@suse.de>

We don't really need to lock down the pages, just make sure they
are uptodate.
Signed-off-by: NJens Axboe <axboe@suse.de>

The whole shadow/pages logic got overly complex, and this simpler
approach is actually faster in testing.
Signed-off-by: NJens Axboe <axboe@suse.de>

__wake_up_common() is pretty heavy in the kernel profiles, this brings
it down to a more acceptable level.
Signed-off-by: NJens Axboe <axboe@suse.de>

We can get to out: with a NULL page, which we probably
don't want to be calling page_cache_release() on.
Signed-off-by: NDave Jones <davej@redhat.com>
Signed-off-by: NJens Axboe <axboe@suse.de>

We should do that, since we do the LRU manipulation ourselves now. Suggested
by Nick Piggin.
Signed-off-by: NJens Axboe <axboe@suse.de>

Originally from Nick Piggin, just adapted to the newer branch.

You can't check PageLRU without holding zone->lru_lock.  The page
release code can get away with it only because the page refcount is 0 at
that point. Also, you can't reliably remove pages from the LRU unless
the refcount is 0. Ever.
Signed-off-by: NNick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: NJens Axboe <axboe@suse.de>

Thanks to Andrew for the good explanation of why this is so. akpm writes:

If a page is under writeback and we remove it from pagecache, it's still
going to get written to disk.  But the VFS no longer knows about that page,
nor that this page is about to modify disk blocks.

So there might be scenarios in which those
blocks-which-are-about-to-be-written-to get reused for something else.
When writeback completes, it'll scribble on those blocks.

This won't happen in ext2/ext3-style filesystems in normal mode because the
page has buffers and try_to_release_page() will fail.

But ext2 in nobh mode doesn't attach buffers at all - it just sticks the
page in a BIO, finds some new blocks, points the BIO at those blocks and
lets it rip.

While that write IO's in flight, someone could truncate the file.  Truncate
won't block on the writeout because the page isn't in pagecache any more.
So truncate will the free the blocks from the file under the page's feet.
Then something else can reallocate those blocks.  Then write data to them.

Now, the original write completes, corrupting the filesystem.
Signed-off-by: NJens Axboe <axboe@suse.de>

Forgot that one, thanks Jeff. Also move the other EXPORT_SYMBOL
to right below the functions.
Signed-off-by: NJens Axboe <axboe@suse.de>

This lets userspace indicate whether more data will be coming in a
subsequent splice call.
Signed-off-by: NJens Axboe <axboe@suse.de>

Hopefully this will make Andrew a little more happy.
Signed-off-by: NJens Axboe <axboe@suse.de>

By cleaning up the writeback logic (killing write_one_page() and the manual
set_page_dirty()), we can get rid of ->stolen inside the pipe_buffer and
just keep it local in pipe_to_file().

This also adds dirty page balancing logic and O_SYNC handling.
Signed-off-by: NJens Axboe <axboe@suse.de>

Clear the entire range, and don't increment pidx or we keep filling
the same position again and again.

Thanks to KAMEZAWA Hiroyuki.
Signed-off-by: NJens Axboe <axboe@suse.de>

It doesn't make the splice itself necessarily nonblocking (because the
actual file descriptors that are spliced from/to may block unless they
have the O_NONBLOCK flag set), but it makes the splice pipe operations
nonblocking.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Woe be unto he who builds their filesystems as modules.
Signed-off-by: NJeff Garzik <jeff@garzik.org>
[ Obscure quote from the infamous geek bible? ]
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This enables the caller to migrate pages from one address space page
cache to another.  In buzz word marketing, you can do zero-copy file
copies!
Signed-off-by: NJens Axboe <axboe@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>