scsi_transport_sas: fix BSG ioctl memory corruption
authorOmar Sandoval <osandov@fb.com>
Tue, 21 Feb 2017 18:03:50 +0000 (10:03 -0800)
committerJens Axboe <axboe@fb.com>
Tue, 21 Feb 2017 21:18:54 +0000 (14:18 -0700)
commitbd1599d931ca735c1081f11aa4d49006350709f1
treeff7260c269e929a3a8c4e66c3f28be0c99c2ccdc
parentcccd9fb9ec960e343b2f354c4613e49f5a1d8371
scsi_transport_sas: fix BSG ioctl memory corruption

The end_device and sas_host devices support BSG ioctls, but the
request_queue allocated for them isn't set up to allocate the struct
scsi_request payload. This leads to memory corruption in the call to
scsi_req_init() in bsg_map_hdr(), since it will memset past the end of
the allocated request. Fix it by setting ->cmd_size on the allocated
request_queue.

Fixes: 82ed4db499b8 ("block: split scsi_request out of struct request")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
drivers/scsi/scsi_transport_sas.c