Messages in this thread | | | Date | Sun, 28 Sep 2003 16:02:55 -0500 (CDT) | From | Derek Foreman <> | Subject | Re: CDROM_SEND_PACKET oddity |
| |
On Sun, 28 Sep 2003, Jens Axboe wrote:
> On Sun, Sep 28 2003, Derek Foreman wrote: > > On Sun, 28 Sep 2003, Jens Axboe wrote: > > > > > On Sat, Sep 27 2003, Derek Foreman wrote: > > > > On Sat, 27 Sep 2003, Jens Axboe wrote: > > > > > > > > - memcpy(hdr.cmdp, cgc.cmd, sizeof(cgc.cmd)); > > > > + hdr.cmdp = (unsigned char *)arg > > > > + + offsetof(struct cdrom_generic_command, cmd); > > > > > > No that's buggy, arg is a user pointer. It needs to read: > > > > > > hdr.cmdp = cgc.cmd; > > > > Actually, hdr.cmdp is expected to be a user pointer. in sg_io we do > > > > rq->cmd_len = hdr->cmd_len; > > if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len)) > > goto out_request; > > if (sizeof(rq->cmd) != hdr->cmd_len) > > Ah you are right, I'd rather kill that too then like I removed user > sg_io_hdr pointer as well. It makes for less error handling in sg_io(). >
That one works great, thanks - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |