Commit 69838727 authored Apr 28, 2009 by FUJITA Tomonori Committed by Jens Axboe Apr 28, 2009

bio: fix memcpy corruption in bio_copy_user_iov()



st driver uses blk_rq_map_user() in order to just build a request out
of page frames. In this case, map_data->offset is a non zero value and
iov[0].iov_base is NULL. We need to increase nr_pages for that.

Cc: stable@kernel.org
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

parent 01919442

fs/bio.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -817,6 +817,9 @@ struct bio bio_copy_user_iov(struct request_queue q,
		len += iov[i].iov_len;
		}

		if (offset)
		nr_pages++;

		bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
		if (!bmd)
		return ERR_PTR(-ENOMEM);