projects / wrapfs-4.14.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 18639c4) | patch
scsi: sg: check length passed to SG_NEXT_CMD_LEN
authorpeter chang <dpf@google.com>
Wed, 15 Feb 2017 22:11:54 +0000 (14:11 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 8 Apr 2017 07:53:31 +0000 (09:53 +0200)
commita92f411914cad6532e82e4607bc4075a5ffaa366
treed03c7b5937fc156757efe22d17be2f06a2475281tree | snapshot
parent18639c4bad72218954e728e9ca65c33b13ba673acommit | diff
scsi: sg: check length passed to SG_NEXT_CMD_LEN

commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/scsi/sg.c diff | blob | history
wrapfs-4.14.y