|
@@ -2348,12 +2348,14 @@ static int nvme_trans_unmap(struct nvme_ns *ns, struct sg_io_hdr *hdr,
|
|
|
|
|
|
static int nvme_scsi_translate(struct nvme_ns *ns, struct sg_io_hdr *hdr)
|
|
static int nvme_scsi_translate(struct nvme_ns *ns, struct sg_io_hdr *hdr)
|
|
{
|
|
{
|
|
- u8 cmd[BLK_MAX_CDB];
|
|
|
|
|
|
+ u8 cmd[16];
|
|
int retcode;
|
|
int retcode;
|
|
unsigned int opcode;
|
|
unsigned int opcode;
|
|
|
|
|
|
if (hdr->cmdp == NULL)
|
|
if (hdr->cmdp == NULL)
|
|
return -EMSGSIZE;
|
|
return -EMSGSIZE;
|
|
|
|
+ if (hdr->cmd_len > sizeof(cmd))
|
|
|
|
+ return -EINVAL;
|
|
if (copy_from_user(cmd, hdr->cmdp, hdr->cmd_len))
|
|
if (copy_from_user(cmd, hdr->cmdp, hdr->cmd_len))
|
|
return -EFAULT;
|
|
return -EFAULT;
|
|
|
|
|
|
@@ -2452,8 +2454,6 @@ int nvme_sg_io(struct nvme_ns *ns, struct sg_io_hdr __user *u_hdr)
|
|
return -EFAULT;
|
|
return -EFAULT;
|
|
if (hdr.interface_id != 'S')
|
|
if (hdr.interface_id != 'S')
|
|
return -EINVAL;
|
|
return -EINVAL;
|
|
- if (hdr.cmd_len > BLK_MAX_CDB)
|
|
|
|
- return -EINVAL;
|
|
|
|
|
|
|
|
/*
|
|
/*
|
|
* A positive return code means a NVMe status, which has been
|
|
* A positive return code means a NVMe status, which has been
|