Merge "scsi: sg: check length passed to SG_NEXT_CMD_LEN"

This commit is contained in:
Linux Build Service Account 2018-01-26 09:41:05 -08:00 committed by Gerrit - the friendly Code Review server
commit 310952f927
1 changed files with 2 additions and 0 deletions

View File

@ -982,6 +982,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
result = get_user(val, ip);
if (result)
return result;
if (val > SG_MAX_CDB_SIZE)
return -ENOMEM;
sfp->next_cmd_len = (val > 0) ? val : 0;
return 0;
case SG_GET_VERSION_NUM: