diff options
| author | Grant Likely <grant.likely@secretlab.ca> | 2010-12-23 00:41:14 -0700 |
|---|---|---|
| committer | Grant Likely <grant.likely@secretlab.ca> | 2010-12-23 00:41:14 -0700 |
| commit | cfb13c5db08c90311a5defdde9a0328ee788cca5 (patch) | |
| tree | 842cb60d1d19b99e550fdbc653723e4b13e51ee5 /drivers/scsi/gdth.c | |
| parent | 4b6ba8aacbb3185703b797286547d0f8f3859b02 (diff) | |
| parent | 90a8a73c06cc32b609a880d48449d7083327e11a (diff) | |
Merge commit 'v2.6.37-rc7' into devicetree/next
Diffstat (limited to 'drivers/scsi/gdth.c')
| -rw-r--r-- | drivers/scsi/gdth.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c index 5a3f93101017..76365700e2d5 100644 --- a/drivers/scsi/gdth.c +++ b/drivers/scsi/gdth.c @@ -185,7 +185,7 @@ static long gdth_unlocked_ioctl(struct file *filep, unsigned int cmd, unsigned long arg); static void gdth_flush(gdth_ha_str *ha); -static int gdth_queuecommand(Scsi_Cmnd *scp,void (*done)(Scsi_Cmnd *)); +static int gdth_queuecommand(struct Scsi_Host *h, struct scsi_cmnd *cmd); static int __gdth_queuecommand(gdth_ha_str *ha, struct scsi_cmnd *scp, struct gdth_cmndinfo *cmndinfo); static void gdth_scsi_done(struct scsi_cmnd *scp); @@ -4004,7 +4004,7 @@ static int gdth_bios_param(struct scsi_device *sdev,struct block_device *bdev,se } -static int gdth_queuecommand(struct scsi_cmnd *scp, +static int gdth_queuecommand_lck(struct scsi_cmnd *scp, void (*done)(struct scsi_cmnd *)) { gdth_ha_str *ha = shost_priv(scp->device->host); @@ -4022,6 +4022,8 @@ static int gdth_queuecommand(struct scsi_cmnd *scp, return __gdth_queuecommand(ha, scp, cmndinfo); } +static DEF_SCSI_QCMD(gdth_queuecommand) + static int __gdth_queuecommand(gdth_ha_str *ha, struct scsi_cmnd *scp, struct gdth_cmndinfo *cmndinfo) { @@ -4177,6 +4179,14 @@ static int ioc_general(void __user *arg, char *cmnd) ha = gdth_find_ha(gen.ionode); if (!ha) return -EFAULT; + + if (gen.data_len > INT_MAX) + return -EINVAL; + if (gen.sense_len > INT_MAX) + return -EINVAL; + if (gen.data_len + gen.sense_len > INT_MAX) + return -EINVAL; + if (gen.data_len + gen.sense_len != 0) { if (!(buf = gdth_ioctl_alloc(ha, gen.data_len + gen.sense_len, FALSE, &paddr))) |