1 files changed, 24 insertions, 0 deletions

diff --git a/fs/compat.c b/fs/compat.c
index 7f8e26ea427c..3f3e8f4d43d6 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1217,6 +1217,10 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
         if (ret < 0)
                 goto out;
 
+        ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
+        if (ret)
+                goto out;
+
         fnv = NULL;
         if (type == READ) {
                 fn = file->f_op->read;
@@ -1313,6 +1317,26 @@ out:
         return ret;
 }
 
+asmlinkage long
+compat_sys_vmsplice(int fd, const struct compat_iovec __user *iov32,
+                    unsigned int nr_segs, unsigned int flags)
+{
+        unsigned i;
+        struct iovec *iov;
+        if (nr_segs >= UIO_MAXIOV)
+                return -EINVAL;
+        iov = compat_alloc_user_space(nr_segs * sizeof(struct iovec));
+        for (i = 0; i < nr_segs; i++) {
+                struct compat_iovec v;
+                if (get_user(v.iov_base, &iov32[i].iov_base) ||
+                    get_user(v.iov_len, &iov32[i].iov_len) ||
+                    put_user(compat_ptr(v.iov_base), &iov[i].iov_base) ||
+                    put_user(v.iov_len, &iov[i].iov_len))
+                        return -EFAULT;
+        }
+        return sys_vmsplice(fd, iov, nr_segs, flags);
+}
+
 /*
  * Exactly like fs/open.c:sys_open(), except that it doesn't set the
  * O_LARGEFILE flag.