From 8e04ad485fa8a1235490128819c5b84f7eb34afe Mon Sep 17 00:00:00 2001 From: FUJITA Tomonori Date: Tue, 28 Apr 2009 20:24:29 +0200 Subject: [PATCH] bio: fix memcpy corruption in bio_copy_user_iov() commit 69838727bcd819a8fd73a88447801221788b0c6d upstream. st driver uses blk_rq_map_user() in order to just build a request out of page frames. In this case, map_data->offset is a non zero value and iov[0].iov_base is NULL. We need to increase nr_pages for that. Cc: stable@kernel.org Signed-off-by: FUJITA Tomonori Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- fs/bio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/bio.c b/fs/bio.c index d4f06327c81..bfdfe57ae3c 100644 --- a/fs/bio.c +++ b/fs/bio.c @@ -806,6 +806,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q, len += iov[i].iov_len; } + if (offset) + nr_pages++; + bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask); if (!bmd) return ERR_PTR(-ENOMEM); -- 2.11.4.GIT