diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2010-09-21 12:14:55 +0400 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2010-09-21 12:14:55 +0400 |
| commit | db8c076b9206ea35b1f7299708d5510b17674db2 (patch) | |
| tree | 7a5ee32db0c25bb29598c7c300ce7f2680f533a9 /fs/aio.c | |
| parent | af6261031317f646d22f994c0b467521e47aa49f (diff) | |
| parent | b30a3f6257ed2105259b404d419b4964e363928c (diff) | |
| download | linux-db8c076b9206ea35b1f7299708d5510b17674db2.tar.xz | |
Merge remote branch 'linus' into drm-intel-fixes
Diffstat (limited to 'fs/aio.c')
| -rw-r--r-- | fs/aio.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -1659,6 +1659,9 @@ long do_io_submit(aio_context_t ctx_id, long nr, if (unlikely(nr < 0)) return -EINVAL; + if (unlikely(nr > LONG_MAX/sizeof(*iocbpp))) + nr = LONG_MAX/sizeof(*iocbpp); + if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp))))) return -EFAULT; |