| commit | 8e04ad485fa8a1235490128819c5b84f7eb34afe | |
| author | FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> | |
| Tue, 28 Apr 2009 18:24:29 +0000 (28 20:24 +0200) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Fri, 8 May 2009 22:45:04 +0000 (8 15:45 -0700) | ||
| tree | 3197e2b6dca7bbb3aafb70f15d40e81e748fbdc7 | treesnapshot (tar.gz zip) |
| parent | 191a87b5f9726f1f78eab51419c9c9548ebc6670 | commitdiff |
bio: fix memcpy corruption in bio_copy_user_iov()
commit 69838727bcd819a8fd73a88447801221788b0c6d upstream.
st driver uses blk_rq_map_user() in order to just build a request out
of page frames. In this case, map_data->offset is a non zero value and
iov[0].iov_base is NULL. We need to increase nr_pages for that.
Cc: stable@kernel.org
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 69838727bcd819a8fd73a88447801221788b0c6d upstream.
st driver uses blk_rq_map_user() in order to just build a request out
of page frames. In this case, map_data->offset is a non zero value and
iov[0].iov_base is NULL. We need to increase nr_pages for that.
Cc: stable@kernel.org
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| fs/bio.c | diffblobblamehistory |