commit | c2a869527865c35b605877f966cb5d514fdc5fbb | [log] [tgz] |
---|---|---|
author | peter chang <dpf@google.com> | Wed Feb 15 14:11:54 2017 -0800 |
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | Sat Apr 08 09:30:32 2017 +0200 |
tree | 490c7d5084ff144e0c54653af7acddc07ab07a3b | |
parent | d5dbd1c9592062ef170fb895f7aa483f781e63f6 [diff] |
scsi: sg: check length passed to SG_NEXT_CMD_LEN commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream. The user can control the size of the next command passed along, but the value passed to the ioctl isn't checked against the usable max command size. Signed-off-by: Peter Chang <dpf@google.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>