diff options
Diffstat (limited to 'fs')
-rw-r--r-- | fs/aio.c | 4 | ||||
-rw-r--r-- | fs/compat.c | 6 | ||||
-rw-r--r-- | fs/read_write.c | 7 |
3 files changed, 8 insertions, 9 deletions
@@ -1446,13 +1446,13 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) | |||
1446 | ret = compat_rw_copy_check_uvector(type, | 1446 | ret = compat_rw_copy_check_uvector(type, |
1447 | (struct compat_iovec __user *)kiocb->ki_buf, | 1447 | (struct compat_iovec __user *)kiocb->ki_buf, |
1448 | kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, | 1448 | kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, |
1449 | &kiocb->ki_iovec, 1); | 1449 | &kiocb->ki_iovec); |
1450 | else | 1450 | else |
1451 | #endif | 1451 | #endif |
1452 | ret = rw_copy_check_uvector(type, | 1452 | ret = rw_copy_check_uvector(type, |
1453 | (struct iovec __user *)kiocb->ki_buf, | 1453 | (struct iovec __user *)kiocb->ki_buf, |
1454 | kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, | 1454 | kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, |
1455 | &kiocb->ki_iovec, 1); | 1455 | &kiocb->ki_iovec); |
1456 | if (ret < 0) | 1456 | if (ret < 0) |
1457 | goto out; | 1457 | goto out; |
1458 | 1458 | ||
diff --git a/fs/compat.c b/fs/compat.c index 0781e619a62a..6556a9ce8a28 100644 --- a/fs/compat.c +++ b/fs/compat.c | |||
@@ -532,7 +532,7 @@ out: | |||
532 | ssize_t compat_rw_copy_check_uvector(int type, | 532 | ssize_t compat_rw_copy_check_uvector(int type, |
533 | const struct compat_iovec __user *uvector, unsigned long nr_segs, | 533 | const struct compat_iovec __user *uvector, unsigned long nr_segs, |
534 | unsigned long fast_segs, struct iovec *fast_pointer, | 534 | unsigned long fast_segs, struct iovec *fast_pointer, |
535 | struct iovec **ret_pointer, int check_access) | 535 | struct iovec **ret_pointer) |
536 | { | 536 | { |
537 | compat_ssize_t tot_len; | 537 | compat_ssize_t tot_len; |
538 | struct iovec *iov = *ret_pointer = fast_pointer; | 538 | struct iovec *iov = *ret_pointer = fast_pointer; |
@@ -579,7 +579,7 @@ ssize_t compat_rw_copy_check_uvector(int type, | |||
579 | } | 579 | } |
580 | if (len < 0) /* size_t not fitting in compat_ssize_t .. */ | 580 | if (len < 0) /* size_t not fitting in compat_ssize_t .. */ |
581 | goto out; | 581 | goto out; |
582 | if (check_access && | 582 | if (type >= 0 && |
583 | !access_ok(vrfy_dir(type), compat_ptr(buf), len)) { | 583 | !access_ok(vrfy_dir(type), compat_ptr(buf), len)) { |
584 | ret = -EFAULT; | 584 | ret = -EFAULT; |
585 | goto out; | 585 | goto out; |
@@ -1094,7 +1094,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file, | |||
1094 | goto out; | 1094 | goto out; |
1095 | 1095 | ||
1096 | tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs, | 1096 | tot_len = compat_rw_copy_check_uvector(type, uvector, nr_segs, |
1097 | UIO_FASTIOV, iovstack, &iov, 1); | 1097 | UIO_FASTIOV, iovstack, &iov); |
1098 | if (tot_len == 0) { | 1098 | if (tot_len == 0) { |
1099 | ret = 0; | 1099 | ret = 0; |
1100 | goto out; | 1100 | goto out; |
diff --git a/fs/read_write.c b/fs/read_write.c index ffc99d22e0a3..c20614f86c01 100644 --- a/fs/read_write.c +++ b/fs/read_write.c | |||
@@ -633,8 +633,7 @@ ssize_t do_loop_readv_writev(struct file *filp, struct iovec *iov, | |||
633 | ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, | 633 | ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, |
634 | unsigned long nr_segs, unsigned long fast_segs, | 634 | unsigned long nr_segs, unsigned long fast_segs, |
635 | struct iovec *fast_pointer, | 635 | struct iovec *fast_pointer, |
636 | struct iovec **ret_pointer, | 636 | struct iovec **ret_pointer) |
637 | int check_access) | ||
638 | { | 637 | { |
639 | unsigned long seg; | 638 | unsigned long seg; |
640 | ssize_t ret; | 639 | ssize_t ret; |
@@ -690,7 +689,7 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, | |||
690 | ret = -EINVAL; | 689 | ret = -EINVAL; |
691 | goto out; | 690 | goto out; |
692 | } | 691 | } |
693 | if (check_access | 692 | if (type >= 0 |
694 | && unlikely(!access_ok(vrfy_dir(type), buf, len))) { | 693 | && unlikely(!access_ok(vrfy_dir(type), buf, len))) { |
695 | ret = -EFAULT; | 694 | ret = -EFAULT; |
696 | goto out; | 695 | goto out; |
@@ -723,7 +722,7 @@ static ssize_t do_readv_writev(int type, struct file *file, | |||
723 | } | 722 | } |
724 | 723 | ||
725 | ret = rw_copy_check_uvector(type, uvector, nr_segs, | 724 | ret = rw_copy_check_uvector(type, uvector, nr_segs, |
726 | ARRAY_SIZE(iovstack), iovstack, &iov, 1); | 725 | ARRAY_SIZE(iovstack), iovstack, &iov); |
727 | if (ret <= 0) | 726 | if (ret <= 0) |
728 | goto out; | 727 | goto out; |
729 | 728 | ||