git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into for-linus
[pandora-kernel.git]
/
fs
/
splice.c
diff --git
a/fs/splice.c
b/fs/splice.c
index
1577a73
..
9b559ee
100644
(file)
--- a/
fs/splice.c
+++ b/
fs/splice.c
@@
-1033,9
+1033,7
@@
ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
done:
pipe->nrbufs = pipe->curbuf = 0;
done:
pipe->nrbufs = pipe->curbuf = 0;
- if (bytes > 0)
- file_accessed(in);
-
+ file_accessed(in);
return bytes;
out_release:
return bytes;
out_release:
@@
-1181,6
+1179,9
@@
static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
{
int partial;
{
int partial;
+ if (!access_ok(VERIFY_READ, src, n))
+ return -EFAULT;
+
pagefault_disable();
partial = __copy_from_user_inatomic(dst, src, n);
pagefault_enable();
pagefault_disable();
partial = __copy_from_user_inatomic(dst, src, n);
pagefault_enable();
@@
-1233,7
+1234,7
@@
static int get_iovec_page_array(const struct iovec __user *iov,
if (unlikely(!len))
break;
error = -EFAULT;
if (unlikely(!len))
break;
error = -EFAULT;
- if (
unlikely(!base
))
+ if (
!access_ok(VERIFY_READ, base, len
))
break;
/*
break;
/*
@@
-1389,6
+1390,11
@@
static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
break;
}
break;
}
+ if (unlikely(!access_ok(VERIFY_WRITE, base, len))) {
+ error = -EFAULT;
+ break;
+ }
+
sd.len = 0;
sd.total_len = len;
sd.flags = flags;
sd.len = 0;
sd.total_len = len;
sd.flags = flags;