diff options
| author | Anders Roxell <anders.roxell@linaro.org> | 2016-08-10 12:11:15 +0200 |
|---|---|---|
| committer | Anders Roxell <anders.roxell@linaro.org> | 2016-08-10 12:11:15 +0200 |
| commit | a44038112d3379f49df8a9db3e1259d9e945faee (patch) | |
| tree | 198f8ef7dcba389b87dbd3cac861d896b5bfd77d /drivers/scsi/sg.c | |
| parent | 590e935df0c94b2d7a4584bb26906666176a6133 (diff) | |
| parent | 0e790100f1c49f32a390d0cc55801230fd04ba56 (diff) | |
Merge remote-tracking branch 'lsk/linux-linaro-lsk-v3.18' into linux-linaro-lsk-v3.18-rtlsk-v3.18-16.09-rtlinux-linaro-lsk-v3.18-rt-test
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Conflicts:
kernel/futex.c
kernel/printk/printk.c
kernel/softirq.c
mm/slub.c
mm/swap.c
Diffstat (limited to 'drivers/scsi/sg.c')
| -rw-r--r-- | drivers/scsi/sg.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 07b2ea1fbf0d..bc09f1d196c9 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -652,7 +652,8 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) else hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE; hp->dxfer_len = mxsize; - if (hp->dxfer_direction == SG_DXFER_TO_DEV) + if ((hp->dxfer_direction == SG_DXFER_TO_DEV) || + (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV)) hp->dxferp = (char __user *)buf + cmd_size; else hp->dxferp = NULL; @@ -1296,7 +1297,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma) } sfp->mmap_called = 1; - vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; + vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP; vma->vm_private_data = sfp; vma->vm_ops = &sg_mmap_vm_ops; return 0; @@ -1785,6 +1786,9 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) md->from_user = 0; } + if (unlikely(iov_count > UIO_MAXIOV)) + return -EINVAL; + if (iov_count) { int len, size = sizeof(struct sg_iovec) * iov_count; struct iovec *iov; |