1 files changed, 14 insertions, 16 deletions

diff --git a/fs/aio.c b/fs/aio.c
index b4a88ccf777..278ed7dc71b 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1395,6 +1395,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
         if (ret < 0)
                 goto out;
 
+        ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
+        if (ret < 0)
+                goto out;
+
         kiocb->ki_nr_segs = kiocb->ki_nbytes;
         kiocb->ki_cur_seg = 0;
         /* ki_nbytes/left now reflect bytes instead of segs */
@@ -1406,11 +1410,17 @@ out:
         return ret;
 }
 
-static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
+static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
 {
+        int bytes;
+
+        bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
+        if (bytes < 0)
+                return bytes;
+
         kiocb->ki_iovec = &kiocb->ki_inline_vec;
         kiocb->ki_iovec->iov_base = kiocb->ki_buf;
-        kiocb->ki_iovec->iov_len = kiocb->ki_left;
+        kiocb->ki_iovec->iov_len = bytes;
         kiocb->ki_nr_segs = 1;
         kiocb->ki_cur_seg = 0;
         return 0;
@@ -1435,10 +1445,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
-                ret = security_file_permission(file, MAY_READ);
-                if (unlikely(ret))
-                        break;
-                ret = aio_setup_single_vector(kiocb);
+                ret = aio_setup_single_vector(READ, file, kiocb);
                 if (ret)
                         break;
                 ret = -EINVAL;
@@ -1453,10 +1460,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
-                ret = security_file_permission(file, MAY_WRITE);
-                if (unlikely(ret))
-                        break;
-                ret = aio_setup_single_vector(kiocb);
+                ret = aio_setup_single_vector(WRITE, file, kiocb);
                 if (ret)
                         break;
                 ret = -EINVAL;
@@ -1467,9 +1471,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 ret = -EBADF;
                 if (unlikely(!(file->f_mode & FMODE_READ)))
                         break;
-                ret = security_file_permission(file, MAY_READ);
-                if (unlikely(ret))
-                        break;
                 ret = aio_setup_vectored_rw(READ, kiocb, compat);
                 if (ret)
                         break;
@@ -1481,9 +1482,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
                 ret = -EBADF;
                 if (unlikely(!(file->f_mode & FMODE_WRITE)))
                         break;
-                ret = security_file_permission(file, MAY_WRITE);
-                if (unlikely(ret))
-                        break;
                 ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
                 if (ret)
                         break;