On Tue, Feb 21, 2017 at 10:03:50AM -0800, Omar Sandoval wrote: > From: Omar Sandoval <osandov@xxxxxx> > > The end_device and sas_host devices support BSG ioctls, but the > request_queue allocated for them isn't set up to allocate the struct > scsi_request payload. This leads to memory corruption in the call to > scsi_req_init() in bsg_map_hdr(), since it will memset past the end of > the allocated request. Fix it by setting ->cmd_size on the allocated > request_queue. Oh, I missed that SAS still opencodes it's queue allocations. Acked-by: Christoph Hellwig <hch@xxxxxx>
