Unchecked use of __get_user in shmfs

[Alan Cox]

The fix below seems rather important.

--- ../linux/mm/shmem.c	Fri Dec 21 17:42:05 2001
+++ mm/shmem.c	Mon Feb 18 19:46:04 2002
@@ -740,6 +749,13 @@
 static struct inode_operations shmem_symlink_inode_operations;
 static struct inode_operations shmem_symlink_inline_operations;
 
+/*
+ *	This is a copy of generic_file_write slightly modified. It would
+ *	help no end if it were kept remotely up to date with the
+ *	generic_file_write changes. I don't alas see a good way to merge
+ *	it back and use the generic one -- Alan
+ */
+ 
 static ssize_t
 shmem_file_write(struct file *file,const char *buf,size_t count,loff_t *ppos)
 {
@@ -751,7 +767,12 @@
 	unsigned long	written;
 	long		status;
 	int		err;
 
+	if ((ssize_t) count < 0)
+		return -EINVAL;
+
+	if (!access_ok(VERIFY_READ, buf, count))
+		return -EFAULT;
 
 	down(&inode->i_sem);