blob: 248bdba08dda9f752cacd8767e7f576e7be09bff (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
diff --git a/fs/splice.c b/fs/splice.c
index 684bca3..2d7e598 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1122,6 +1122,11 @@ static int get_iovec_page_array(const struct iovec __user *iov,
size_t len;
int i;
+ if (!access_ok(VERIFY_READ, iov, sizeof(struct iovec))) {
+ error = -EFAULT;
+ break;
+ }
+
/*
* Get user address base and length for this iovec.
*/
@@ -1141,6 +1146,11 @@ static int get_iovec_page_array(const struct iovec __user *iov,
if (unlikely(!base))
break;
+ if (!access_ok(VERIFY_READ, base, len)) {
+ error = -EFAULT;
+ break;
+ }
+
/*
* Get this base offset and number of pages, then map
* in the user pages.
|
GitWeb
