mac80211: Fix Unreachable Mesh Station Problem when joining to another MBSS

[pandora-kernel.git] / fs / aio.c

diff --git a/fs/aio.c b/fs/aio.c
index 67a6db3..55c4c76 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -134,9 +134,9 @@ static int aio_setup_ring(struct kioctx *ctx)
        info->mmap_size = nr_pages * PAGE_SIZE;
        dprintk("attempting mmap of %lu bytes\n", info->mmap_size);
        down_write(&ctx->mm->mmap_sem);
-       info->mmap_base = do_mmap(NULL, 0, info->mmap_size, 
-                                 PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE,
-                                 0);
+       info->mmap_base = do_mmap_pgoff(NULL, 0, info->mmap_size, 
+                                       PROT_READ|PROT_WRITE,
+                                       MAP_ANONYMOUS|MAP_PRIVATE, 0);
        if (IS_ERR((void *)info->mmap_base)) {
                up_write(&ctx->mm->mmap_sem);
                info->mmap_size = 0;
@@ -1446,13 +1446,17 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
                ret = compat_rw_copy_check_uvector(type,
                                (struct compat_iovec __user *)kiocb->ki_buf,
                                kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
-                               &kiocb->ki_iovec, 1);
+                               &kiocb->ki_iovec);
        else
 #endif
                ret = rw_copy_check_uvector(type,
                                (struct iovec __user *)kiocb->ki_buf,
                                kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
-                               &kiocb->ki_iovec, 1);
+                               &kiocb->ki_iovec);
+       if (ret < 0)
+               goto out;
+
+       ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
        if (ret < 0)
                goto out;
 
@@ -1467,11 +1471,17 @@ out:
        return ret;
 }
 
-static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
+static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
 {
+       int bytes;
+
+       bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
+       if (bytes < 0)
+               return bytes;
+
        kiocb->ki_iovec = &kiocb->ki_inline_vec;
        kiocb->ki_iovec->iov_base = kiocb->ki_buf;
-       kiocb->ki_iovec->iov_len = kiocb->ki_left;
+       kiocb->ki_iovec->iov_len = bytes;
        kiocb->ki_nr_segs = 1;
        kiocb->ki_cur_seg = 0;
        return 0;
@@ -1496,10 +1506,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
                        kiocb->ki_left)))
                        break;
-               ret = security_file_permission(file, MAY_READ);
-               if (unlikely(ret))
-                       break;
-               ret = aio_setup_single_vector(kiocb);
+               ret = aio_setup_single_vector(READ, file, kiocb);
                if (ret)
                        break;
                ret = -EINVAL;
@@ -1514,10 +1521,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
                        kiocb->ki_left)))
                        break;
-               ret = security_file_permission(file, MAY_WRITE);
-               if (unlikely(ret))
-                       break;
-               ret = aio_setup_single_vector(kiocb);
+               ret = aio_setup_single_vector(WRITE, file, kiocb);
                if (ret)
                        break;
                ret = -EINVAL;
@@ -1528,9 +1532,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                ret = -EBADF;
                if (unlikely(!(file->f_mode & FMODE_READ)))
                        break;
-               ret = security_file_permission(file, MAY_READ);
-               if (unlikely(ret))
-                       break;
                ret = aio_setup_vectored_rw(READ, kiocb, compat);
                if (ret)
                        break;
@@ -1542,9 +1543,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                ret = -EBADF;
                if (unlikely(!(file->f_mode & FMODE_WRITE)))
                        break;
-               ret = security_file_permission(file, MAY_WRITE);
-               if (unlikely(ret))
-                       break;
                ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
                if (ret)
                        break;