Re: [PATCH 1/2] scsi: scsi_ioctl: Validate command size
From: Bart Van Assche
Date: Tue Nov 02 2021 - 23:32:42 EST
On 11/2/21 17:37, Tadeusz Struk wrote:
+ if (hdr->cmd_len < 6 || hdr->cmd_len > sizeof(req->__cmd))
+ return -EMSGSIZE;
That doesn't look right to me since sg_io() allocates req->cmd if necessary:
if (hdr->cmd_len > BLK_MAX_CDB) {
req->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL);
if (!req->cmd)
goto out_put_request;
}
Bart.