From: Alan Cox <alan@linux.intel.com>
Date: Tue, 27 Oct 2009 15:35:35 +0000 (+0000)
Subject: dpt_i2o: Fix up copy*user
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=ef7562b7f28319e6dd1f85dc1af87df2a7a84832;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

dpt_i2o: Fix up copy*user

Signed-off-by: Alan Cox <alan@linux.intel.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index b6af63ca980b..7d1aac31ec8d 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
 		}
 		size = size>>16;
 		size *= 4;
+		if (size > MAX_MESSAGE_SIZE) {
+			rcode = EINVAL;
+			goto cleanup;
+		}
 		/* Copy in the user's I2O command */
 		if (copy_from_user (msg, user_msg, size)) {
 			rcode = -EFAULT;