linux/drivers/scsi/sg.c
peter chang c2a8695278 scsi: sg: check length passed to SG_NEXT_CMD_LEN
commit bf33f87dd0 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-04-08 09:30:32 +02:00

2705 lines
72 KiB