diff options
author | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | 2009-04-28 20:24:29 +0200 |
---|---|---|
committer | Jens Axboe <jens.axboe@oracle.com> | 2009-04-28 20:24:29 +0200 |
commit | 69838727bcd819a8fd73a88447801221788b0c6d (patch) | |
tree | 4fd6c31c1078ac079ea1ba0fa9cdf4aa581f06a7 /fs | |
parent | 0191944282e84931f92915b5f06b348a92dac7e1 (diff) | |
download | op-kernel-dev-69838727bcd819a8fd73a88447801221788b0c6d.zip op-kernel-dev-69838727bcd819a8fd73a88447801221788b0c6d.tar.gz |
bio: fix memcpy corruption in bio_copy_user_iov()
st driver uses blk_rq_map_user() in order to just build a request out
of page frames. In this case, map_data->offset is a non zero value and
iov[0].iov_base is NULL. We need to increase nr_pages for that.
Cc: stable@kernel.org
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/bio.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q, len += iov[i].iov_len; } + if (offset) + nr_pages++; + bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask); if (!bmd) return ERR_PTR(-ENOMEM); |