| From 84ce0f0e94ac97217398b3b69c21c7a62ebeed05 Mon Sep 17 00:00:00 2001 |
| From: Jan Kara <jack@suse.cz> |
| Date: Wed, 22 Oct 2014 20:13:39 -0600 |
| Subject: scsi: Fix error handling in SCSI_IOCTL_SEND_COMMAND |
| |
| From: Jan Kara <jack@suse.cz> |
| |
| commit 84ce0f0e94ac97217398b3b69c21c7a62ebeed05 upstream. |
| |
| When sg_scsi_ioctl() fails to prepare request to submit in |
| blk_rq_map_kern() we jump to a label where we just end up copying |
| (luckily zeroed-out) kernel buffer to userspace instead of reporting |
| error. Fix the problem by jumping to the right label. |
| |
| CC: Jens Axboe <axboe@kernel.dk> |
| CC: linux-scsi@vger.kernel.org |
| Coverity-id: 1226871 |
| Signed-off-by: Jan Kara <jack@suse.cz> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| Fixed up the, now unused, out label. |
| |
| Signed-off-by: Jens Axboe <axboe@fb.com> |
| |
| --- |
| block/scsi_ioctl.c | 3 +-- |
| 1 file changed, 1 insertion(+), 2 deletions(-) |
| |
| --- a/block/scsi_ioctl.c |
| +++ b/block/scsi_ioctl.c |
| @@ -509,7 +509,7 @@ int sg_scsi_ioctl(struct request_queue * |
| |
| if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { |
| err = DRIVER_ERROR << 24; |
| - goto out; |
| + goto error; |
| } |
| |
| memset(sense, 0, sizeof(sense)); |
| @@ -518,7 +518,6 @@ int sg_scsi_ioctl(struct request_queue * |
| |
| blk_execute_rq(q, disk, rq, 0); |
| |
| -out: |
| err = rq->errors & 0xff; /* only 8 bit SCSI status */ |
| if (err) { |
| if (rq->sense_len && rq->sense) { |
