summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2015-03-22 03:02:55 +0300
committerAl Viro <viro@zeniv.linux.org.uk>2015-04-12 05:27:13 +0300
commite272b89ff8fb63902294ba6eadd14729e2880ade (patch)
tree3f4fc8ed45aeba9cbdeed96be27311326da451ee
parent17d17e728224f69311675e2ff312e992b7cc7b1e (diff)
downloadlinux-e272b89ff8fb63902294ba6eadd14729e2880ade.tar.xz
sg_io(): use import_iovec()
... and don't skip access_ok() validation. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--block/scsi_ioctl.c12
1 files changed, 5 insertions, 7 deletions
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index e1f71c396193..55b6f15dac90 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -335,16 +335,14 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
struct iov_iter i;
struct iovec *iov = NULL;
- ret = rw_copy_check_uvector(-1, hdr->dxferp, hdr->iovec_count,
- 0, NULL, &iov);
- if (ret < 0) {
- kfree(iov);
+ ret = import_iovec(rq_data_dir(rq),
+ hdr->dxferp, hdr->iovec_count,
+ 0, &iov, &i);
+ if (ret < 0)
goto out_free_cdb;
- }
/* SG_IO howto says that the shorter of the two wins */
- iov_iter_init(&i, rq_data_dir(rq), iov, hdr->iovec_count,
- min_t(unsigned, ret, hdr->dxfer_len));
+ iov_iter_truncate(&i, hdr->dxfer_len);
ret = blk_rq_map_user_iov(q, rq, NULL, &i, GFP_KERNEL);
kfree(iov);