Commit 9284bcf4 authored by Jens Axboe's avatar Jens Axboe
Browse files

block: check for proper length of iov entries in blk_rq_map_user_iov() 



Ensure that we pass down properly validated iov segments before
calling into the mapping or copy functions.

Reported-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: default avatarJens Axboe <jaxboe@fusionio.com>
parent 151f52f0

block/blk-map.c

+2 −0
Original line number Diff line number Diff line
@@ -205,6 +205,8 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, 
			unaligned = 1;

			break;

		}

		if (!iov[i].iov_len)

			return -EINVAL;

	}



	if (unaligned || (q->dma_pad_mask & len) || map_data)