X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=fs%2Fsplice.c;h=9b559ee711a8e59f8e12fb0029b4d5a0356b7df4;hb=c58310bf4933986513020fa90b4190c7492995ae;hp=1577a7391d23fa47cd74fb5089278dba81daee55;hpb=9e97198dbf318be7958b57900d05b37c7e09ad7c;p=pandora-kernel.git

diff --git a/fs/splice.c b/fs/splice.c
index 1577a7391d23..9b559ee711a8 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1033,9 +1033,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
 
 done:
 	pipe->nrbufs = pipe->curbuf = 0;
-	if (bytes > 0)
-		file_accessed(in);
-
+	file_accessed(in);
 	return bytes;
 
 out_release:
@@ -1181,6 +1179,9 @@ static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
 {
 	int partial;
 
+	if (!access_ok(VERIFY_READ, src, n))
+		return -EFAULT;
+
 	pagefault_disable();
 	partial = __copy_from_user_inatomic(dst, src, n);
 	pagefault_enable();
@@ -1233,7 +1234,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
 		if (unlikely(!len))
 			break;
 		error = -EFAULT;
-		if (unlikely(!base))
+		if (!access_ok(VERIFY_READ, base, len))
 			break;
 
 		/*
@@ -1389,6 +1390,11 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
 			break;
 		}
 
+		if (unlikely(!access_ok(VERIFY_WRITE, base, len))) {
+			error = -EFAULT;
+			break;
+		}
+
 		sd.len = 0;
 		sd.total_len = len;
 		sd.flags = flags;