summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>2009-04-28 20:24:29 +0200
committerJens Axboe <jens.axboe@oracle.com>2009-04-28 20:24:29 +0200
commit69838727bcd819a8fd73a88447801221788b0c6d (patch)
tree4fd6c31c1078ac079ea1ba0fa9cdf4aa581f06a7
parent0191944282e84931f92915b5f06b348a92dac7e1 (diff)
downloadlinux-69838727bcd819a8fd73a88447801221788b0c6d.tar.bz2
bio: fix memcpy corruption in bio_copy_user_iov()
st driver uses blk_rq_map_user() in order to just build a request out of page frames. In this case, map_data->offset is a non zero value and iov[0].iov_base is NULL. We need to increase nr_pages for that. Cc: stable@kernel.org Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
-rw-r--r--fs/bio.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/bio.c b/fs/bio.c
index 7bbc98f0eda1..98711647ece4 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
len += iov[i].iov_len;
}
+ if (offset)
+ nr_pages++;
+
bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
if (!bmd)
return ERR_PTR(-ENOMEM);