Commit 8cc86c08 authored by Jens Axboe's avatar Jens Axboe Committed by Linus Torvalds

[PATCH] scsi_ioctl memcpy'ing user address

James reported a bug in scsi_ioctl.c where it mem copies a user pointer
instead of using copy_from_user(). I inadvertently introduced this one
when getting rid of CDROM_SEND_PACKET. Here's a trivial patch to fix it.
parent 5dbe8bb5
...@@ -216,7 +216,12 @@ static int sg_io(request_queue_t *q, struct block_device *bdev, ...@@ -216,7 +216,12 @@ static int sg_io(request_queue_t *q, struct block_device *bdev,
* fill in request structure * fill in request structure
*/ */
rq->cmd_len = hdr->cmd_len; rq->cmd_len = hdr->cmd_len;
memcpy(rq->cmd, hdr->cmdp, hdr->cmd_len);
if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len)) {
blk_put_request(rq);
return -EFAULT;
}
if (sizeof(rq->cmd) != hdr->cmd_len) if (sizeof(rq->cmd) != hdr->cmd_len)
memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len); memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment