RDS: check access on pages before doing copy_to_user

Signed-off-by: Chris Mason <chris.mason@oracle.com>
Signed-off-by: Bang Nguyen <bang.nguyen@oracle.com>

diff --git a/net/rds/page.c b/net/rds/page.c
index b94b8e119d4b202300bbe246a3573551f885e327..fe5adbb5aa4172a1842fda952447d2406f4f6789 100644 (file)
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -56,6 +56,14 @@ int rds_page_copy_user(struct page *page, unsigned long offset,
        unsigned long ret;
        void *addr;
 
+       if (to_user)
+               ret = access_ok(VERIFY_WRITE, ptr, bytes);
+       else
+               ret = access_ok(VERIFY_READ, ptr, bytes);
+
+       if (!ret)
+               return -EFAULT;
+
        if (to_user)
                rds_stats_add(s_copy_to_user, bytes);
        else