--- fs/bio.c

+++ fs/bio.c

@@ -371,6 +371,9 @@ struct bio *bio_kmalloc(gfp_t gfp_mask,

{

struct bio *bio;

+ if (nr_iovecs > UIO_MAXIOV)

+ return NULL;

+

bio = kmalloc(sizeof(struct bio) + nr_iovecs * sizeof(struct bio_vec),

gfp_mask);

if (unlikely(!bio))

@@ -701,8 +704,12 @@ static void bio_free_map_data(struct bio

static struct bio_map_data *bio_alloc_map_data(int nr_segs, int iov_count,

gfp_t gfp_mask)

{

- struct bio_map_data *bmd = kmalloc(sizeof(*bmd), gfp_mask);

+ struct bio_map_data *bmd;

+ if (iov_count > UIO_MAXIOV)

+ return NULL;

+

+ bmd = kmalloc(sizeof(*bmd), gfp_mask);

if (!bmd)

return NULL;

@@ -831,6 +838,12 @@ struct bio *bio_copy_user_iov(struct req

end = (uaddr + iov[i].iov_len + PAGE_SIZE - 1) >> PAGE_SHIFT;

start = uaddr >> PAGE_SHIFT;

+ /*

+ * Overflow, abort

+ */

+ if (end < start)

+ return ERR_PTR(-EINVAL);

+

nr_pages += end - start;

len += iov[i].iov_len;

}

@@ -958,6 +971,12 @@ static struct bio *__bio_map_user_iov(st

unsigned long end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;

unsigned long start = uaddr >> PAGE_SHIFT;

+ /*

+ * Overflow, abort

+ */

+ if (end < start)

+ return ERR_PTR(-EINVAL);

+

nr_pages += end - start;

/*

* buffer must be aligned to at least hardsector size for now

@@ -985,7 +1004,7 @@ static struct bio *__bio_map_user_iov(st

unsigned long start = uaddr >> PAGE_SHIFT;

const int local_nr_pages = end - start;

const int page_limit = cur_page + local_nr_pages;

-

+

ret = get_user_pages_fast(uaddr, local_nr_pages,

write_to_vm, &pages[cur_page]);

if (ret < local_nr_pages) {