Merge "scsi: sg: check length passed to SG_NEXT_CMD_LEN"
This commit is contained in:
commit
310952f927
|
@ -982,6 +982,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
|
|||
result = get_user(val, ip);
|
||||
if (result)
|
||||
return result;
|
||||
if (val > SG_MAX_CDB_SIZE)
|
||||
return -ENOMEM;
|
||||
sfp->next_cmd_len = (val > 0) ? val : 0;
|
||||
return 0;
|
||||
case SG_GET_VERSION_NUM:
|
||||
|
|
Loading…
Reference in New Issue