[PATCH] SG_SET_RESERVED_SIZE negative oops

I propose the 2.6.0-test8 two-line patch below to teach
SG_SET_RESERVED_SIZE to reject a negative size, rather than oops-ing.

diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
index 11be2d8b346ff421f66c865faf6a8538cbf77fb5..82397e2b0e22704fb268fb2bbc5a84db84d6c4c0 100644 (file)
--- a/drivers/block/scsi_ioctl.c
+++ b/drivers/block/scsi_ioctl.c
@@ -124,6 +124,8 @@ static int sg_set_reserved_size(request_queue_t *q, int *p)
        if (err)
                return err;
 
+       if (size < 0)
+               return -EINVAL;
        if (size > (q->max_sectors << 9))
                return -EINVAL;
 

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 5f5ed2a275666bbbdf21485d0ef1eb76e0d94150..39597fe7d77c6c733764a46d855970fcea6b4731 100644 (file)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -877,6 +877,8 @@ sg_ioctl(struct inode *inode, struct file *filp,
                result = get_user(val, (int *) arg);
                if (result)
                        return result;
+               if (val < 0)
+                       return -EINVAL;
                if (val != sfp->reserve.bufflen) {
                        if (sg_res_in_use(sfp) || sfp->mmap_called)
                                return -EBUSY;