The patch titled Subject: i2o: check copy_from_user() size parameter has been removed from the -mm tree. Its filename was i2o-check-copy_from_user-size-parameter.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Subject: i2o: check copy_from_user() size parameter Limit the size of the copy so we don't corrupt memory. Hopefully this can only be called by root, but fixing this makes the static checkers happier. Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Cc: Jiri Kosina <jkosina@xxxxxxx> Cc: Masanari Iida <standby24x7@xxxxxxxxx> Cc: Alan Cox <alan@xxxxxxxxxxxxxxx> Cc: Guenter Roeck <linux@xxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/message/i2o/i2o_config.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff -puN drivers/message/i2o/i2o_config.c~i2o-check-copy_from_user-size-parameter drivers/message/i2o/i2o_config.c --- a/drivers/message/i2o/i2o_config.c~i2o-check-copy_from_user-size-parameter +++ a/drivers/message/i2o/i2o_config.c @@ -687,6 +687,11 @@ static int i2o_cfg_passthru32(struct fil } size = size >> 16; size *= 4; + if (size > sizeof(rmsg)) { + rcode = -EINVAL; + goto sg_list_cleanup; + } + /* Copy in the user's I2O command */ if (copy_from_user(rmsg, user_msg, size)) { rcode = -EFAULT; @@ -922,6 +927,11 @@ static int i2o_cfg_passthru(unsigned lon } size = size >> 16; size *= 4; + if (size > sizeof(rmsg)) { + rcode = -EFAULT; + goto sg_list_cleanup; + } + /* Copy in the user's I2O command */ if (copy_from_user(rmsg, user_msg, size)) { rcode = -EFAULT; _ Patches currently in -mm which might be from dan.carpenter@xxxxxxxxxx are origin.patch linux-next.patch mwave-fix-info-leak-in-mwave_ioctl.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html