diff options
| author | Alan Cox <alan@linux.intel.com> | 2009-10-27 15:35:35 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-11-09 16:51:55 -0800 |
| commit | c1e746f840b02765dd3dceaa1097986e04a5c066 (patch) | |
| tree | 800264bc159a11bb6dc25c6db6d0fdbdb914c4f9 | |
| parent | 9a3e3d7cf51eeafaad9f90c7c1d8f0b97ed0687e (diff) | |
dpt_i2o: Fix up copy*user
commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 upstream.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/scsi/dpt_i2o.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c index 771614521f3..2821285f68e 100644 --- a/drivers/scsi/dpt_i2o.c +++ b/drivers/scsi/dpt_i2o.c @@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg) } size = size>>16; size *= 4; + if (size > MAX_MESSAGE_SIZE) { + rcode = EINVAL; + goto cleanup; + } /* Copy in the user's I2O command */ if (copy_from_user (msg, user_msg, size)) { rcode = -EFAULT; |