summaryrefslogtreecommitdiff
path: root/drivers/scsi/dpt_i2o.c
diff options
context:
space:
mode:
authorAlan Cox <alan@linux.intel.com>2009-10-27 18:35:35 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2009-10-29 19:01:07 +0300
commitef7562b7f28319e6dd1f85dc1af87df2a7a84832 (patch)
tree6aa1059426764b68f8698e24ccd7c9946d00fb5d /drivers/scsi/dpt_i2o.c
parent0a53f1693cb956ebd8ba0a9acca6adb2dcb99d5f (diff)
downloadlinux-ef7562b7f28319e6dd1f85dc1af87df2a7a84832.tar.xz
dpt_i2o: Fix up copy*user
Signed-off-by: Alan Cox <alan@linux.intel.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/scsi/dpt_i2o.c')
-rw-r--r--drivers/scsi/dpt_i2o.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index b6af63ca980b..7d1aac31ec8d 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
}
size = size>>16;
size *= 4;
+ if (size > MAX_MESSAGE_SIZE) {
+ rcode = EINVAL;
+ goto cleanup;
+ }
/* Copy in the user's I2O command */
if (copy_from_user (msg, user_msg, size)) {
rcode = -EFAULT;