diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2015-03-22 01:25:30 +0100 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2015-04-12 04:27:14 +0200 |
| commit | fdc81f45e9f57858da6351836507fbcf1b7583ee (patch) | |
| tree | 3f7e4ec5af122eccf85ab526ad01e8df01848f2b /drivers | |
| parent | sg_start_req(): make sure that there's not too many elements in iovec (diff) | |
| download | linux-fdc81f45e9f57858da6351836507fbcf1b7583ee.tar.xz linux-fdc81f45e9f57858da6351836507fbcf1b7583ee.zip | |
sg_start_req(): use import_iovec()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/scsi/sg.c | 16 |
1 files changed, 5 insertions, 11 deletions
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index b5a4db883223..9d7b7db75e4b 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1744,21 +1744,15 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) md->from_user = 0; } - if (unlikely(iov_count > MAX_UIOVEC)) - return -EINVAL; - if (iov_count) { - int size = sizeof(struct iovec) * iov_count; - struct iovec *iov; + struct iovec *iov = NULL; struct iov_iter i; - iov = memdup_user(hp->dxferp, size); - if (IS_ERR(iov)) - return PTR_ERR(iov); + res = import_iovec(rw, hp->dxferp, iov_count, 0, &iov, &i); + if (res < 0) + return res; - iov_iter_init(&i, rw, iov, iov_count, - min_t(size_t, hp->dxfer_len, - iov_length(iov, iov_count))); + iov_iter_truncate(&i, hp->dxfer_len); res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC); kfree(iov); |