Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a92f4119 authored by peter chang's avatar peter chang Committed by Greg Kroah-Hartman
Browse files

scsi: sg: check length passed to SG_NEXT_CMD_LEN 



commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: default avatarPeter Chang <dpf@google.com>
Acked-by: default avatarDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 18639c4b

drivers/scsi/sg.c

+2 −0
Original line number Diff line number Diff line
@@ -1008,6 +1008,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) 
		result = get_user(val, ip);

		if (result)

			return result;

		if (val > SG_MAX_CDB_SIZE)

			return -ENOMEM;

		sfp->next_cmd_len = (val > 0) ? val : 0;

		return 0;

	case SG_GET_VERSION_NUM: