Files
linux-stable-mirror/drivers/scsi
Omar Sandoval bd1599d931 scsi_transport_sas: fix BSG ioctl memory corruption
The end_device and sas_host devices support BSG ioctls, but the
request_queue allocated for them isn't set up to allocate the struct
scsi_request payload. This leads to memory corruption in the call to
scsi_req_init() in bsg_map_hdr(), since it will memset past the end of
the allocated request. Fix it by setting ->cmd_size on the allocated
request_queue.

Fixes: 82ed4db499 ("block: split scsi_request out of struct request")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
2017-02-21 14:18:54 -07:00
..
2016-11-08 17:29:56 -05:00
2017-02-08 10:51:24 -08:00
2016-12-25 17:21:22 +01:00
2016-05-10 22:01:07 -04:00
2017-01-31 14:00:34 -07:00
2016-02-25 21:10:53 -05:00
2016-11-08 17:29:46 -05:00
2016-02-23 21:27:02 -05:00
2016-11-28 15:51:31 -05:00
2016-12-25 17:21:22 +01:00
2017-01-31 14:00:34 -07:00
2016-11-14 13:16:42 -07:00
2016-10-18 19:49:11 -06:00
2016-02-23 21:27:02 -05:00
2016-02-23 21:27:02 -05:00