diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2015-03-21 20:02:55 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2015-04-11 22:27:13 -0400 |
| commit | e272b89ff8fb63902294ba6eadd14729e2880ade (patch) | |
| tree | 3f4fc8ed45aeba9cbdeed96be27311326da451ee | |
| parent | 17d17e728224f69311675e2ff312e992b7cc7b1e (diff) | |
| download | linux-rt-e272b89ff8fb63902294ba6eadd14729e2880ade.tar.gz | |
sg_io(): use import_iovec()
... and don't skip access_ok() validation.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | block/scsi_ioctl.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c index e1f71c396193..55b6f15dac90 100644 --- a/block/scsi_ioctl.c +++ b/block/scsi_ioctl.c @@ -335,16 +335,14 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk, struct iov_iter i; struct iovec *iov = NULL; - ret = rw_copy_check_uvector(-1, hdr->dxferp, hdr->iovec_count, - 0, NULL, &iov); - if (ret < 0) { - kfree(iov); + ret = import_iovec(rq_data_dir(rq), + hdr->dxferp, hdr->iovec_count, + 0, &iov, &i); + if (ret < 0) goto out_free_cdb; - } /* SG_IO howto says that the shorter of the two wins */ - iov_iter_init(&i, rq_data_dir(rq), iov, hdr->iovec_count, - min_t(unsigned, ret, hdr->dxfer_len)); + iov_iter_truncate(&i, hdr->dxfer_len); ret = blk_rq_map_user_iov(q, rq, NULL, &i, GFP_KERNEL); kfree(iov); |