Message ID | 1439369820-27005-74-git-send-email-luis.henriques@canonical.com |
---|---|
State | New |
Headers | show |
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 791460b798f4..2aa95c89b5bf 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -1693,6 +1693,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd) md->from_user = 0; } + if (unlikely(iov_count > UIO_MAXIOV)) + return -EINVAL; + if (iov_count) { int len, size = sizeof(struct sg_iovec) * iov_count; struct iovec *iov;