kernel-vmsplice.patch

   1 diff --git a/fs/splice.c b/fs/splice.c
   2 index 684bca3..2d7e598 100644
   3 --- a/fs/splice.c
   4 +++ b/fs/splice.c
   5 @@ -1122,6 +1122,11 @@ static int get_iovec_page_array(const struct iovec __user *iov,
   6                 size_t len;
   7                 int i;
   8
   9 +               if (!access_ok(VERIFY_READ, iov, sizeof(struct iovec))) {
  10 +                       error = -EFAULT;
  11 +                       break;
  12 +               }
  13 +
  14                 /*
  15                  * Get user address base and length for this iovec.
  16                  */
  17 @@ -1141,6 +1146,11 @@ static int get_iovec_page_array(const struct iovec __user *iov,
  18                 if (unlikely(!base))
  19                         break;
  20
  21 +               if (!access_ok(VERIFY_READ, base, len)) {
  22 +                       error = -EFAULT;
  23 +                       break;
  24 +               }
  25 +
  26                 /*
  27                  * Get this base offset and number of pages, then map
  28                  * in the user pages.