git.openpandora.org
/
pandora-kernel.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
1581668
)
block: check for proper length of iov entries in blk_rq_map_user_iov()
author
Jens Axboe
<jaxboe@fusionio.com>
Fri, 29 Oct 2010 14:10:18 +0000
(08:10 -0600)
committer
Greg Kroah-Hartman
<gregkh@suse.de>
Thu, 9 Dec 2010 21:24:15 +0000
(13:24 -0800)
commit
9284bcf4e335e5f18a8bc7b26461c33ab60d0689
upstream.
Ensure that we pass down properly validated iov segments before
calling into the mapping or copy functions.
Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
block/blk-map.c
patch
|
blob
|
history
diff --git
a/block/blk-map.c
b/block/blk-map.c
index
af37e4a
..
bdf10b9
100644
(file)
--- a/
block/blk-map.c
+++ b/
block/blk-map.c
@@
-191,6
+191,8
@@
int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
unaligned = 1;
break;
}
+ if (!iov[i].iov_len)
+ return -EINVAL;
}
if (unaligned || (q->dma_pad_mask & len))