and another: dm-ioctl(): In retrieve_status(), make sure we don't overrun the ioctl buffer. [Kevin Corry] --- diff/drivers/md/dm-ioctl.c 2004-04-06 15:54:15.433160624 +0100 +++ source/drivers/md/dm-ioctl.c 2004-04-06 17:06:17.948038480 +0100 @@ -815,6 +815,10 @@ static void retrieve_status(struct dm_ta outptr += sizeof(struct dm_target_spec); remaining = len - (outptr - outbuf); + if (remaining <= 0) { + param->flags |= DM_BUFFER_FULL_FLAG; + break; + } /* Get the status/table string from the target driver */ if (ti->type->status) {