From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Date: Tue, 28 Apr 2009 18:24:29 +0000 (+0200)
Subject: bio: fix memcpy corruption in bio_copy_user_iov()
X-Git-Tag: v2.6.29.3~34
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8e04ad485fa8a1235490128819c5b84f7eb34afe;p=thirdparty%2Fkernel%2Fstable.git

bio: fix memcpy corruption in bio_copy_user_iov()

commit 69838727bcd819a8fd73a88447801221788b0c6d upstream.

st driver uses blk_rq_map_user() in order to just build a request out
of page frames. In this case, map_data->offset is a non zero value and
iov[0].iov_base is NULL. We need to increase nr_pages for that.

Cc: stable@kernel.org
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/fs/bio.c b/fs/bio.c
index d4f06327c810b..bfdfe57ae3cc4 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -806,6 +806,9 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
 		len += iov[i].iov_len;
 	}
 
+	if (offset)
+		nr_pages++;
+
 	bmd = bio_alloc_map_data(nr_pages, iov_count, gfp_mask);
 	if (!bmd)
 		return ERR_PTR(-ENOMEM);