diff options
Diffstat (limited to 'drivers/scsi')
| -rw-r--r-- | drivers/scsi/scsi_lib.c | 3 | ||||
| -rw-r--r-- | drivers/scsi/sg.c | 4 |
2 files changed, 6 insertions, 1 deletions
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index cf5b99e1f12b..8558e3886960 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c @@ -1120,7 +1120,8 @@ int scsi_init_io(struct scsi_cmnd *cmd) bool is_mq = (rq->mq_ctx != NULL); int error; - BUG_ON(!rq->nr_phys_segments); + if (WARN_ON_ONCE(!rq->nr_phys_segments)) + return -EINVAL; error = scsi_init_sgtable(rq, &cmd->sdb); if (error) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index a1c29b0afb22..dedcff9cabb5 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1763,6 +1763,10 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) return res; iov_iter_truncate(&i, hp->dxfer_len); + if (!iov_iter_count(&i)) { + kfree(iov); + return -EINVAL; + } res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC); kfree(iov); |