--- fs/splice.c

+++ fs/splice.c

@@ -638,9 +638,11 @@ static int pipe_to_sendpage(struct pipe_

ret = buf->ops->confirm(pipe, buf);

if (!ret) {

more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;

-

- ret = file->f_op->sendpage(file, buf->page, buf->offset,

- sd->len, &pos, more);

+ if (file->f_op && file->f_op->sendpage)

+ ret = file->f_op->sendpage(file, buf->page, buf->offset,

+ sd->len, &pos, more);

+ else

+ ret = -EINVAL;

}

return ret;

@@ -1058,8 +1060,9 @@ static long do_splice_from(struct pipe_i

if (unlikely(ret < 0))

return ret;

- splice_write = out->f_op->splice_write;

- if (!splice_write)

+ if (out->f_op && out->f_op->splice_write)

+ splice_write = out->f_op->splice_write;

+ else

splice_write = default_file_splice_write;

return splice_write(pipe, out, ppos, len, flags);

@@ -1083,8 +1086,9 @@ static long do_splice_to(struct file *in

if (unlikely(ret < 0))

return ret;

- splice_read = in->f_op->splice_read;

- if (!splice_read)

+ if (in->f_op && in->f_op->splice_read)

+ splice_read = in->f_op->splice_read;

+ else

splice_read = default_file_splice_read;

return splice_read(in, ppos, pipe, len, flags);

@@ -1306,7 +1310,8 @@ static long do_splice(struct file *in, l

if (off_in)

return -ESPIPE;

if (off_out) {

- if (out->f_op->llseek == no_llseek)

+ if (!out->f_op || !out->f_op->llseek ||

+ out->f_op->llseek == no_llseek)

return -EINVAL;

if (copy_from_user(&offset, off_out, sizeof(loff_t)))

return -EFAULT;

@@ -1326,7 +1331,8 @@ static long do_splice(struct file *in, l

if (off_out)

return -ESPIPE;

if (off_in) {

- if (in->f_op->llseek == no_llseek)

+ if (!in->f_op || !in->f_op->llseek ||

+ in->f_op->llseek == no_llseek)

return -EINVAL;

if (copy_from_user(&offset, off_in, sizeof(loff_t)))

return -EFAULT;