Code: xfs_file_splice_write(
	struct pipe_inode_info	*pipe,
	struct file		*outfilp,
	loff_t			*ppos,
	size_t			count,
	unsigned int		flags)
{
	struct inode		*inode = outfilp->f_mapping->host;
	struct xfs_inode	*ip = XFS_I(inode);
	int			ioflags = 0;
	ssize_t			ret;
	XFS_STATS_INC(xs_write_calls);
	if (outfilp->f_mode & FMODE_NOCMTIME)
		ioflags |= IO_INVIS;
	if (XFS_FORCED_SHUTDOWN(ip->i_mount))
		return -EIO;
	xfs_ilock(ip, XFS_IOLOCK_EXCL);
	trace_xfs_file_splice_write(ip, count, *ppos, ioflags);
	ret = generic_file_splice_write(pipe, outfilp, ppos, count, flags);
	if (ret > 0)
		XFS_STATS_ADD(xs_write_bytes, ret);
	xfs_iunlock(ip, XFS_IOLOCK_EXCL);
	return ret;
}

Vulnerability Type: DoS 
CWE ID: CWE-264
Summary: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.
Commit Message: ->splice_write() via ->write_iter()

iter_file_splice_write() - a ->splice_write() instance that gathers the
pipe buffers, builds a bio_vec-based iov_iter covering those and feeds
it to ->write_iter().  A bunch of simple cases coverted to that...

[AV: fixed the braino spotted by Cyrill]

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>