From 8cc86c08950c41dc88006534c3508d03cf0dfe39 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Mon, 8 Dec 2003 17:03:05 -0800 Subject: [PATCH] [PATCH] scsi_ioctl memcpy'ing user address James reported a bug in scsi_ioctl.c where it mem copies a user pointer instead of using copy_from_user(). I inadvertently introduced this one when getting rid of CDROM_SEND_PACKET. Here's a trivial patch to fix it. --- drivers/block/scsi_ioctl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c index 82397e2b0e227..ca1eadb173403 100644 --- a/drivers/block/scsi_ioctl.c +++ b/drivers/block/scsi_ioctl.c @@ -216,7 +216,12 @@ static int sg_io(request_queue_t *q, struct block_device *bdev, * fill in request structure */ rq->cmd_len = hdr->cmd_len; - memcpy(rq->cmd, hdr->cmdp, hdr->cmd_len); + + if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len)) { + blk_put_request(rq); + return -EFAULT; + } + if (sizeof(rq->cmd) != hdr->cmd_len) memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len); -- 2.53.0