39 lines
1.3 KiB
Diff
39 lines
1.3 KiB
Diff
|
From: Xiaotian Feng <dfeng@redhat.com>
|
||
|
Date: Mon, 29 Nov 2010 09:03:55 +0000 (+0100)
|
||
|
Subject: block: check for proper length of iov entries earlier in blk_rq_map_user_iov()
|
||
|
X-Git-Tag: v2.6.37-rc7~10^2~5
|
||
|
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=54787556
|
||
|
|
||
|
block: check for proper length of iov entries earlier in blk_rq_map_user_iov()
|
||
|
|
||
|
commit 9284bcf checks for proper length of iov entries in
|
||
|
blk_rq_map_user_iov(). But if the map is unaligned, kernel
|
||
|
will break out the loop without checking for the proper length.
|
||
|
So we need to check the proper length before the unalign check.
|
||
|
|
||
|
Signed-off-by: Xiaotian Feng <dfeng@redhat.com>
|
||
|
Cc: stable@kernel.org
|
||
|
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
|
||
|
---
|
||
|
|
||
|
diff --git a/block/blk-map.c b/block/blk-map.c
|
||
|
index 5d5dbe4..e663ac2 100644
|
||
|
--- a/block/blk-map.c
|
||
|
+++ b/block/blk-map.c
|
||
|
@@ -201,12 +201,13 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
|
||
|
for (i = 0; i < iov_count; i++) {
|
||
|
unsigned long uaddr = (unsigned long)iov[i].iov_base;
|
||
|
|
||
|
+ if (!iov[i].iov_len)
|
||
|
+ return -EINVAL;
|
||
|
+
|
||
|
if (uaddr & queue_dma_alignment(q)) {
|
||
|
unaligned = 1;
|
||
|
break;
|
||
|
}
|
||
|
- if (!iov[i].iov_len)
|
||
|
- return -EINVAL;
|
||
|
}
|
||
|
|
||
|
if (unaligned || (q->dma_pad_mask & len) || map_data)
|