tree 96d22fce7ace55680cb69cda9d411b49edbcfbce
parent b02aa4f82886766fddfb86f700dce51a0d811e84
author peter chang <dpf@google.com> 1487196714 -0800
committer Todd Kjos <tkjos@google.com> 1512431495 -0800

scsi: sg: check length passed to SG_NEXT_CMD_LEN

commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>