Re: [PATCH 1/2] scsi: scsi_ioctl: Validate command size

[Bart Van Assche <bvanassche@xxxxxxx>]

On 11/2/21 17:37, Tadeusz Struk wrote:
> +	if (hdr->cmd_len < 6 || hdr->cmd_len > sizeof(req->__cmd))
> +		return -EMSGSIZE;

That doesn't look right to me since sg_io() allocates req->cmd if necessary:

	if (hdr->cmd_len > BLK_MAX_CDB) {
		req->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL);
		if (!req->cmd)
			goto out_put_request;
	}

Bart.