@@ -371,6 +371,7 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
unsigned int nr_pages;
size_t offset, base, copied = 0;
ssize_t res;
+ bool gup;
int i;
if (pipe->nrbufs == pipe->buffers)
@@ -383,7 +384,7 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
offset = *ppos & ~PAGE_MASK;
iov_iter_pipe(&to, READ, pipe, len + offset);
-
+ gup = iov_iter_get_pages_use_gup(&to);
res = iov_iter_get_pages_alloc(&to, &pages, len + offset, &base);
if (res <= 0)
return -ENOMEM;
@@ -419,8 +420,12 @@ static ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
if (vec != __vec)
kfree(vec);
out:
- for (i = 0; i < nr_pages; i++)
- put_page(pages[i]);
+ for (i = 0; i < nr_pages; i++) {
+ if (gup)
+ put_user_page(pages[i]);
+ else
+ put_page(pages[i]);
+ }
kvfree(pages);
iov_iter_advance(&to, copied); /* truncates and discards */
return res;