Files
linux/drivers
Omar Sandoval bd1599d931 scsi_transport_sas: fix BSG ioctl memory corruption
The end_device and sas_host devices support BSG ioctls, but the
request_queue allocated for them isn't set up to allocate the struct
scsi_request payload. This leads to memory corruption in the call to
scsi_req_init() in bsg_map_hdr(), since it will memset past the end of
the allocated request. Fix it by setting ->cmd_size on the allocated
request_queue.

Fixes: 82ed4db499 ("block: split scsi_request out of struct request")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
2017-02-21 14:18:54 -07:00
..
2016-12-25 10:47:44 +01:00
2017-02-20 14:23:40 +01:00
2016-12-25 17:21:22 +01:00
2016-12-25 10:47:44 +01:00
2017-02-20 14:22:50 +01:00