scsi: scsi_ioctl: Validate command size

[linux-2.6-microblaze.git] / drivers / scsi / scsi_ioctl.c

diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index 6ff2207..a06c61f 100644 (file)
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -347,6 +347,8 @@ static int scsi_fill_sghdr_rq(struct scsi_device *sdev, struct request *rq,
 {
        struct scsi_request *req = scsi_req(rq);
 
+       if (hdr->cmd_len < 6)
+               return -EMSGSIZE;
        if (copy_from_user(req->cmd, hdr->cmdp, hdr->cmd_len))
                return -EFAULT;
        if (!scsi_cmd_allowed(req->cmd, mode))