Messages in this thread | | | Date | Tue, 2 Nov 2021 20:32:33 -0700 | Subject | Re: [PATCH 1/2] scsi: scsi_ioctl: Validate command size | From | Bart Van Assche <> |
| |
On 11/2/21 17:37, Tadeusz Struk wrote: > + if (hdr->cmd_len < 6 || hdr->cmd_len > sizeof(req->__cmd)) > + return -EMSGSIZE;
That doesn't look right to me since sg_io() allocates req->cmd if necessary:
if (hdr->cmd_len > BLK_MAX_CDB) { req->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL); if (!req->cmd) goto out_put_request; }
Bart.
| |