2.6.24.7

 fs

diff --git a/fs/splice.c b/fs/splice.c
index 6bdcb61..109153c 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -314,7 +314,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
             break;
 
          error = add_to_page_cache_lru(page, mapping, index,
-                     GFP_KERNEL);
+                  mapping_gfp_mask(mapping));
          if (unlikely(error)) {
             page_cache_release(page);
             if (error == -EEXIST)
@@ -1184,6 +1184,9 @@ static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
 {
    int partial;
 
+   if (!access_ok(VERIFY_READ, src, n))
+      return -EFAULT;
+
    pagefault_disable();
    partial = __copy_from_user_inatomic(dst, src, n);
    pagefault_enable();
@@ -1236,7 +1239,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
       if (unlikely(!len))
          break;
       error = -EFAULT;
-      if (unlikely(!base))
+      if (!access_ok(VERIFY_READ, base, len))
          break;
 
       /*
@@ -1392,6 +1395,11 @@ static long vmsplice_to_user(struct file *file, const struct iovec __user *iov,
          break;
       }
 
+      if (unlikely(!access_ok(VERIFY_WRITE, base, len))) {
+         error = -EFAULT;
+         break;
+      }
+
       sd.len = 0;
       sd.total_len = len;
       sd.flags = flags;