2.6.24.2

 fs

diff --git a/fs/splice.c b/fs/splice.c
index 6bdcb61..e313478 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1184,6 +1184,9 @@ static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
 {
    int partial;
 
+   if (!access_ok(VERIFY_READ, src, n))
+      return -EFAULT;
+
    pagefault_disable();
    partial = __copy_from_user_inatomic(dst, src, n);
    pagefault_enable();
@@ -1236,7 +1239,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
       if (unlikely(!len))
          break;
       error = -EFAULT;
-      if (unlikely(!base))
+      if (!access_ok(VERIFY_READ, base, len))
          break;
 
       /*
@@ -1392,6 +1395,11 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
          break;
       }
 
+      if (unlikely(!access_ok(VERIFY_WRITE, base, len))) {
+         error = -EFAULT;
+         break;
+      }
+
       sd.len = 0;
       sd.total_len = len;
       sd.flags = flags;