]>
Commit | Line | Data |
---|---|---|
238a0533 AM |
1 | diff --git a/fs/splice.c b/fs/splice.c |
2 | index 684bca3..2d7e598 100644 | |
3 | --- a/fs/splice.c | |
4 | +++ b/fs/splice.c | |
5 | @@ -1122,6 +1122,11 @@ static int get_iovec_page_array(const struct iovec __user *iov, | |
c0070fcf AM |
6 | size_t len; |
7 | int i; | |
8 | ||
238a0533 AM |
9 | + if (!access_ok(VERIFY_READ, iov, sizeof(struct iovec))) { |
10 | + error = -EFAULT; | |
11 | + break; | |
c0070fcf AM |
12 | + } |
13 | + | |
14 | /* | |
15 | * Get user address base and length for this iovec. | |
16 | */ | |
238a0533 AM |
17 | @@ -1141,6 +1146,11 @@ static int get_iovec_page_array(const struct iovec __user *iov, |
18 | if (unlikely(!base)) | |
19 | break; | |
20 | ||
21 | + if (!access_ok(VERIFY_READ, base, len)) { | |
22 | + error = -EFAULT; | |
23 | + break; | |
24 | + } | |
25 | + | |
26 | /* | |
27 | * Get this base offset and number of pages, then map | |
28 | * in the user pages. |