Re: [PATCH 1/2] scsi: scsi_ioctl: Validate command size

[Tadeusz Struk <tadeusz.struk@xxxxxxxxxx>]

On 11/2/21 20:32, Bart Van Assche wrote:
> > +    if (hdr->cmd_len < 6 || hdr->cmd_len > sizeof(req->__cmd))
> > +        return -EMSGSIZE;
>
> That doesn't look right to me since sg_io() allocates req->cmd if necessary:
>
>      if (hdr->cmd_len > BLK_MAX_CDB) {
>          req->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL);
>          if (!req->cmd)
>              goto out_put_request;
>      }

I missed that. I will send a v2 soon.

--
Thanks,
Tadeusz