From: Kevin Corry dm-ioctl.c::retrieve_status(): Prevent overrunning the ioctl buffer by making sure we don't call the target status routine with a buffer size limit of zero. [Kevin Corry, Alasdair Kergon] --- 25-akpm/drivers/md/dm-ioctl.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletion(-) diff -puN drivers/md/dm-ioctl.c~dm-retrieve_status-prevent-overrunning-the-ioctl-buffer drivers/md/dm-ioctl.c --- 25/drivers/md/dm-ioctl.c~dm-retrieve_status-prevent-overrunning-the-ioctl-buffer Mon Apr 12 13:48:55 2004 +++ 25-akpm/drivers/md/dm-ioctl.c Mon Apr 12 13:48:55 2004 @@ -789,7 +789,7 @@ static void retrieve_status(struct dm_ta struct dm_target *ti = dm_table_get_target(table, i); remaining = len - (outptr - outbuf); - if (remaining < sizeof(struct dm_target_spec)) { + if (remaining <= sizeof(struct dm_target_spec)) { param->flags |= DM_BUFFER_FULL_FLAG; break; } @@ -804,6 +804,10 @@ static void retrieve_status(struct dm_ta outptr += sizeof(struct dm_target_spec); remaining = len - (outptr - outbuf); + if (remaining <= 0) { + param->flags |= DM_BUFFER_FULL_FLAG; + break; + } /* Get the status/table string from the target driver */ if (ti->type->status) { _