| Date | Fri, 06 Nov 2009 14:14:29 -0800 | From | Greg KH <> | Subject | [31/99] dpt_i2o: Fix up copy*user |
| |
2.6.31-stable review patch. If anyone has any objections, please let us know.
------------------ From: Alan Cox <alan@linux.intel.com>
commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 upstream.
Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- drivers/scsi/dpt_i2o.c | 4 ++++ 1 file changed, 4 insertions(+)
--- a/drivers/scsi/dpt_i2o.c +++ b/drivers/scsi/dpt_i2o.c @@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* p } size = size>>16; size *= 4; + if (size > MAX_MESSAGE_SIZE) { + rcode = EINVAL; + goto cleanup; + } /* Copy in the user's I2O command */ if (copy_from_user (msg, user_msg, size)) { rcode = -EFAULT;
|