splice: remove permission hook from iter_file_splice_write()

All the callers of ->splice_write(), (e.g. do_splice_direct() and
do_splice()) already check rw_verify_area() for the entire range
and perform all the other checks that are in vfs_write_iter().

Instead of creating another tiny helper for special caller, just
open-code it.

This is needed for fanotify "pre content" events.

Suggested-by: Jan Kara <jack@suse.cz>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://lore.kernel.org/r/20231122122715.2561213-6-amir73il@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/splice.c b/fs/splice.c
index d4fdd44c0b328054fb94262e95e6413804c10410..3fce5f6072ddf2aa5f8123b904f439ae6d4651fe 100644 (file)
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -673,10 +673,13 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
                .u.file = out,
        };
        int nbufs = pipe->max_usage;
-       struct bio_vec *array = kcalloc(nbufs, sizeof(struct bio_vec),
-                                       GFP_KERNEL);
+       struct bio_vec *array;
        ssize_t ret;
 
+       if (!out->f_op->write_iter)
+               return -EINVAL;
+
+       array = kcalloc(nbufs, sizeof(struct bio_vec), GFP_KERNEL);
        if (unlikely(!array))
                return -ENOMEM;
 
@@ -684,6 +687,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
 
        splice_from_pipe_begin(&sd);
        while (sd.total_len) {
+               struct kiocb kiocb;
                struct iov_iter from;
                unsigned int head, tail, mask;
                size_t left;
@@ -733,7 +737,10 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
                }
 
                iov_iter_bvec(&from, ITER_SOURCE, array, n, sd.total_len - left);
-               ret = vfs_iter_write(out, &from, &sd.pos, 0);
+               init_sync_kiocb(&kiocb, out);
+               kiocb.ki_pos = sd.pos;
+               ret = call_write_iter(out, &kiocb, &from);
+               sd.pos = kiocb.ki_pos;
                if (ret <= 0)
                        break;