diff options
| author | Stefan Agner <stefan@agner.ch> | 2017-03-14 13:59:28 -0700 |
|---|---|---|
| committer | Max Krummenacher <max.krummenacher@toradex.com> | 2017-03-15 18:35:51 +0100 |
| commit | 39ac0033f2345ce7b5d8ca4439192407dacb2355 (patch) | |
| tree | 51dc588baa63d31bc406388885f62c1cae068fa3 /drivers/scsi/sg.c | |
| parent | 13f2767f31803754aa883f298737aff866f04628 (diff) | |
| parent | d9e0350d2575a20ee7783427da9bd6b6107eb983 (diff) | |
Merge tag 'v4.1.39' into toradex_vf_4.1-nexttoradex_vf_4.1
Linux 4.1.39
Diffstat (limited to 'drivers/scsi/sg.c')
| -rw-r--r-- | drivers/scsi/sg.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index ec192939750e..0cc067ce5715 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -592,6 +592,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) sg_io_hdr_t *hp; unsigned char cmnd[SG_MAX_CDB_SIZE]; + if (unlikely(segment_eq(get_fs(), KERNEL_DS))) + return -EINVAL; + if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) return -ENXIO; SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, @@ -1754,6 +1757,10 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) return res; iov_iter_truncate(&i, hp->dxfer_len); + if (!iov_iter_count(&i)) { + kfree(iov); + return -EINVAL; + } res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC); kfree(iov); |