Re: [PATCH 1/2] scsi: scsi_ioctl: Validate command size

From: Tadeusz Struk
Date: Wed Nov 03 2021 - 10:40:54 EST

On 11/2/21 20:32, Bart Van Assche wrote:
+    if (hdr->cmd_len < 6 || hdr->cmd_len > sizeof(req->__cmd))
+        return -EMSGSIZE;

That doesn't look right to me since sg_io() allocates req->cmd if necessary:

    if (hdr->cmd_len > BLK_MAX_CDB) {
        req->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL);
        if (!req->cmd)
            goto out_put_request;
    }

I missed that. I will send a v2 soon.

--
Thanks,
Tadeusz