From d0e5f8c08162ea4117b4917682e1688b93375fc1 Mon Sep 17 00:00:00 2001 From: Pat LaVarre Date: Wed, 22 Oct 2003 23:24:04 -0500 Subject: [PATCH] [PATCH] SG_SET_RESERVED_SIZE negative oops I propose the 2.6.0-test8 two-line patch below to teach SG_SET_RESERVED_SIZE to reject a negative size, rather than oops-ing. --- drivers/block/scsi_ioctl.c | 2 ++ drivers/scsi/sg.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c index 11be2d8b346ff..82397e2b0e227 100644 --- a/drivers/block/scsi_ioctl.c +++ b/drivers/block/scsi_ioctl.c @@ -124,6 +124,8 @@ static int sg_set_reserved_size(request_queue_t *q, int *p) if (err) return err; + if (size < 0) + return -EINVAL; if (size > (q->max_sectors << 9)) return -EINVAL; diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 5f5ed2a275666..39597fe7d77c6 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -877,6 +877,8 @@ sg_ioctl(struct inode *inode, struct file *filp, result = get_user(val, (int *) arg); if (result) return result; + if (val < 0) + return -EINVAL; if (val != sfp->reserve.bufflen) { if (sg_res_in_use(sfp) || sfp->mmap_called) return -EBUSY; -- 2.53.0