Signed-off-by: Andrew Morton --- 25-akpm/fs/select.c | 7 ++++--- 25-akpm/include/linux/poll.h | 8 +++++--- fs/binfmt_elf.c | 0 3 files changed, 9 insertions(+), 6 deletions(-) diff -puN include/linux/poll.h~copy_to_user-checking include/linux/poll.h --- 25/include/linux/poll.h~copy_to_user-checking 2004-08-25 23:45:24.589102368 -0700 +++ 25-akpm/include/linux/poll.h 2004-08-25 23:47:21.218372024 -0700 @@ -5,6 +5,7 @@ #ifdef __KERNEL__ +#include #include #include #include @@ -81,11 +82,12 @@ int get_fd_set(unsigned long nr, void __ return 0; } -static inline -void set_fd_set(unsigned long nr, void __user *ufdset, unsigned long *fdset) +static inline unsigned long __must_check +set_fd_set(unsigned long nr, void __user *ufdset, unsigned long *fdset) { if (ufdset) - __copy_to_user(ufdset, fdset, FDS_BYTES(nr)); + return __copy_to_user(ufdset, fdset, FDS_BYTES(nr)); + return 0; } static inline diff -puN fs/select.c~copy_to_user-checking fs/select.c --- 25/fs/select.c~copy_to_user-checking 2004-08-25 23:50:34.755949840 -0700 +++ 25-akpm/fs/select.c 2004-08-25 23:52:04.898246128 -0700 @@ -373,9 +373,10 @@ sys_select(int n, fd_set __user *inp, fd ret = 0; } - set_fd_set(n, inp, fds.res_in); - set_fd_set(n, outp, fds.res_out); - set_fd_set(n, exp, fds.res_ex); + if (set_fd_set(n, inp, fds.res_in) || + set_fd_set(n, outp, fds.res_out) || + set_fd_set(n, exp, fds.res_ex)) + ret = -EFAULT; out: select_bits_free(bits, size); diff -puN fs/binfmt_elf.c~copy_to_user-checking fs/binfmt_elf.c _