diff options
| -rw-r--r-- | drivers/scsi/mpi3mr/mpi3mr_app.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c index 8e5d24793efd..1cd1c38dcd56 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_app.c +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c @@ -2538,6 +2538,14 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) rval = -EINVAL; goto out; } + if (sgl_iter + mpi_msg_size > + dout_buf + job->request_payload.payload_len) { + dprint_bsg_err(mrioc, "%s: MPI request buf exceeds dout_buf\n", + __func__); + mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } memcpy(mpi_req, sgl_iter, mpi_msg_size); break; default: |