From 71b19676e909a91bbbf2b12e5b3067fee570f77f Mon Sep 17 00:00:00 2001
From: Jens Axboe <jens.axboe@oracle.com>
Date: Fri, 8 Feb 2008 08:49:14 -0800
Subject: [PATCH] --- yaml --- r: 84832 b: refs/heads/master c:
 8811930dc74a503415b35c4a79d14fb0b408a361 h: refs/heads/master v: v3

---
 [refs]            | 2 +-
 trunk/fs/splice.c | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 19c812b2195e..da98e74950ba 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 66191dc622f5ff0a541524c4e96fdacfacfda206
+refs/heads/master: 8811930dc74a503415b35c4a79d14fb0b408a361
diff --git a/trunk/fs/splice.c b/trunk/fs/splice.c
index 4ee49e86edde..14e2262c0a04 100644
--- a/trunk/fs/splice.c
+++ b/trunk/fs/splice.c
@@ -1179,6 +1179,9 @@ static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
 {
 	int partial;
 
+	if (!access_ok(VERIFY_READ, src, n))
+		return -EFAULT;
+
 	pagefault_disable();
 	partial = __copy_from_user_inatomic(dst, src, n);
 	pagefault_enable();
@@ -1387,6 +1390,11 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
 			break;
 		}
 
+		if (unlikely(!access_ok(VERIFY_WRITE, base, len))) {
+			error = -EFAULT;
+			break;
+		}
+
 		sd.len = 0;
 		sd.total_len = len;
 		sd.flags = flags;