--- fs/splice.c.old	2008-02-10 14:47:11.000000000 -0700
+++ fs/splice.c	2008-02-10 14:47:53.000000000 -0700
@@ -1182,6 +1182,9 @@
 		if (unlikely(!base))
 			break;
 
+		if (unlikely(!access_ok(VERIFY_READ, base, len)))
+			break;
+
 		/*
 		 * Get this base offset and number of pages, then map
 		 * in the user pages.