DivestOS/Patches/Linux_CVEs/CVE-2015-5707/1.patch

45 lines
1.2 KiB
Diff

From fdc81f45e9f57858da6351836507fbcf1b7583ee Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 21 Mar 2015 20:25:30 -0400
Subject: sg_start_req(): use import_iovec()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
drivers/scsi/sg.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index b5a4db8..9d7b7db 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1744,21 +1744,15 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
md->from_user = 0;
}
- if (unlikely(iov_count > MAX_UIOVEC))
- return -EINVAL;
-
if (iov_count) {
- int size = sizeof(struct iovec) * iov_count;
- struct iovec *iov;
+ struct iovec *iov = NULL;
struct iov_iter i;
- iov = memdup_user(hp->dxferp, size);
- if (IS_ERR(iov))
- return PTR_ERR(iov);
+ res = import_iovec(rw, hp->dxferp, iov_count, 0, &iov, &i);
+ if (res < 0)
+ return res;
- iov_iter_init(&i, rw, iov, iov_count,
- min_t(size_t, hp->dxfer_len,
- iov_length(iov, iov_count)));
+ iov_iter_truncate(&i, hp->dxfer_len);
res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC);
kfree(iov);
--
cgit v1.1