* Bastian Blank:
> diff --git a/fs/splice.c b/fs/splice.c
> index 684bca3..2d7e598 100644
> --- a/fs/splice.c
> +++ b/fs/splice.c
> @@ -1122,6 +1122,11 @@ static int get_iovec_page_array(const struct iovec
> __user *iov,
> size_t len;
> int i;
>
> + if (!access_ok(VERIFY_READ, iov, sizeof(struct iovec))) {
> + error = -EFAULT;
> + break;
> + }
> +
> /*
> * Get user address base and length for this iovec.
> */
For the record, the above hunk is unnecessary because the get_user()
calls which immediately follow the quoted code perform implict
access_ok() checks. CVE-2008-0010 does NOT apply to our 2.6.18 kernel
(but the additional access_ok() call doesn't cause any harm, either).
I'm writing this because some vendors have released pre-2.6.23 patches
without this hunk, and I don't want to create impression they are still
vulnerable.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
