[PATCH] scsi_ioctl memcpy'ing user address

James reported a bug in scsi_ioctl.c where it mem copies a user pointer
instead of using copy_from_user(). I inadvertently introduced this one
when getting rid of CDROM_SEND_PACKET. Here's a trivial patch to fix it.

diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
index 82397e2b0e22704fb268fb2bbc5a84db84d6c4c0..ca1eadb1734032fdf15ac76fb00d97489532b99e 100644 (file)
--- a/drivers/block/scsi_ioctl.c
+++ b/drivers/block/scsi_ioctl.c
@@ -216,7 +216,12 @@ static int sg_io(request_queue_t *q, struct block_device *bdev,
         * fill in request structure
         */
        rq->cmd_len = hdr->cmd_len;
-       memcpy(rq->cmd, hdr->cmdp, hdr->cmd_len);
+
+       if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len)) {
+               blk_put_request(rq);
+               return -EFAULT;
+       }
+
        if (sizeof(rq->cmd) != hdr->cmd_len)
                memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len);