scsi_transport_sas: fix BSG ioctl memory corruption
The end_device and sas_host devices support BSG ioctls, but the request_queue allocated for them isn't set up to allocate the struct scsi_request payload. This leads to memory corruption in the call to scsi_req_init() in bsg_map_hdr(), since it will memset past the end of the allocated request. Fix it by setting ->cmd_size on the allocated request_queue. Fixes: 82ed4db4 ("block: split scsi_request out of struct request") Signed-off-by: NOmar Sandoval <osandov@fb.com> Acked-by: NChristoph Hellwig <hch@lst.de> Signed-off-by: NJens Axboe <axboe@fb.com>
Showing
想要评论请 注册 或 登录