diff options
Diffstat (limited to 'queue-3.16/scsi-sg-add-sg_remove_request-in-sg_common_write.patch')
| -rw-r--r-- | queue-3.16/scsi-sg-add-sg_remove_request-in-sg_common_write.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/queue-3.16/scsi-sg-add-sg_remove_request-in-sg_common_write.patch b/queue-3.16/scsi-sg-add-sg_remove_request-in-sg_common_write.patch new file mode 100644 index 00000000..c869cda4 --- /dev/null +++ b/queue-3.16/scsi-sg-add-sg_remove_request-in-sg_common_write.patch @@ -0,0 +1,34 @@ +From: Li Bin <huawei.libin@huawei.com> +Date: Mon, 13 Apr 2020 19:29:21 +0800 +Subject: scsi: sg: add sg_remove_request in sg_common_write + +commit 849f8583e955dbe3a1806e03ecacd5e71cce0a08 upstream. + +If the dxfer_len is greater than 256M then the request is invalid and we +need to call sg_remove_request in sg_common_write. + +Link: https://lore.kernel.org/r/1586777361-17339-1-git-send-email-huawei.libin@huawei.com +Fixes: f930c7043663 ("scsi: sg: only check for dxfer_len greater than 256M") +Acked-by: Douglas Gilbert <dgilbert@interlog.com> +Signed-off-by: Li Bin <huawei.libin@huawei.com> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/sg.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -808,8 +808,10 @@ sg_common_write(Sg_fd * sfp, Sg_request + SCSI_LOG_TIMEOUT(4, printk("sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", + (int) cmnd[0], (int) hp->cmd_len)); + +- if (hp->dxfer_len >= SZ_256M) ++ if (hp->dxfer_len >= SZ_256M) { ++ sg_remove_request(sfp, srp); + return -EINVAL; ++ } + + k = sg_start_req(srp, cmnd); + if (k) { |