[lkml]   [2008]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] vmsplice exploit fix (was: splice: fix user pointer access in get_iovec_page_array)
Kudos to all involved in the rapid response.  But.

Information on patching this vulnerability is not available front and
center in many of the places you would expect: front page, front page, covered on but without a
pointer to the patch, and so on. So this post provides a subject line
for Google to find, and for good measure mentions the word


I think many users would first go to on a day like today, as
I did. Nothing to see there. We could do a way better job of getting
the word out.

Patch attached as posted above by Pekka. For the mortals among us:

cd linux-2.6.recent && patch <fix.vmsplice.exploit.patch -p1


Cc: <>
Cc: Jens Axboe <>
Cc: Andrew Morton <>
Signed-off-by: Pekka Enberg <>
Bastian, can I have your Signed-off-by for this, please? Oliver, Niki, can
you please confirm this closes the hole?

fs/splice.c | 3 +++
1 file changed, 3 insertions(+)

Index: linux-2.6/fs/splice.c
--- linux-2.6.orig/fs/splice.c
+++ linux-2.6/fs/splice.c
@@ -1237,6 +1237,9 @@ static int get_iovec_page_array(const st
if (unlikely(!base))

+ if (unlikely(!access_ok(VERIFY_READ, base, len)))
+ break;
* Get this base offset and number of pages, then map
* in the user pages.
 \ /
  Last update: 2008-02-11 08:33    [W:0.109 / U:0.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site