Re: [PATCH] scsi: sg: fix a missing-check bug

2018-05-18 Thread Wenwen Wang
On Mon, May 7, 2018 at 12:13 AM, Douglas Gilbert wrote: > On 2018-05-05 11:21 PM, Wenwen Wang wrote: >> >> In sg_write(), the opcode of the command is firstly copied from the >> userspace pointer 'buf' and saved to the kernel variable 'opcode', using >> the __get_user() function. The size of the c

Re: [PATCH] scsi: sg: fix a missing-check bug

2018-05-06 Thread Douglas Gilbert
On 2018-05-05 11:21 PM, Wenwen Wang wrote: In sg_write(), the opcode of the command is firstly copied from the userspace pointer 'buf' and saved to the kernel variable 'opcode', using the __get_user() function. The size of the command, i.e., 'cmd_size' is then calculated based on the 'opcode'. Af

[PATCH] scsi: sg: fix a missing-check bug

2018-05-05 Thread Wenwen Wang
In sg_write(), the opcode of the command is firstly copied from the userspace pointer 'buf' and saved to the kernel variable 'opcode', using the __get_user() function. The size of the command, i.e., 'cmd_size' is then calculated based on the 'opcode'. After that, the whole command, including the op