bio: fix memcpy corruption in bio_copy_user_iov()
st driver uses blk_rq_map_user() in order to just build a request out of page frames. In this case, map_data->offset is a non zero value and iov[0].iov_base is NULL. We need to increase nr_pages for that. Cc: stable@kernel.org Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
This commit is contained in:
Родитель
0191944282
Коммит
69838727bc
3
fs/bio.c
3
fs/bio.c
|
@ -817,6 +817,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
|
|||
len += iov[i].iov_len;
|
||||
}
|
||||
|
||||
if (offset)
|
||||
nr_pages++;
|
||||
|
||||
bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
|
||||
if (!bmd)
|
||||
return ERR_PTR(-ENOMEM);
|
||||
|
|
Загрузка…
Ссылка в новой задаче