diff options
| author | Al Viro <viro@ftp.linux.org.uk> | 2006-02-26 08:34:10 -0600 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-02-26 09:09:49 -0800 |
| commit | 489708007785389941a89fa06aedc5ec53303c96 (patch) | |
| tree | 425e0dda8d5fec842ffdd3b2cdadfeaf60f5a668 /drivers/char/sx.c | |
| parent | a0124d780d06db711e8a92135d774940588a27da (diff) | |
| download | linux-489708007785389941a89fa06aedc5ec53303c96.tar.gz linux-489708007785389941a89fa06aedc5ec53303c96.tar.bz2 linux-489708007785389941a89fa06aedc5ec53303c96.zip | |
[PATCH] sd: fix memory corruption with broken mode page headers
There's a problem in sd where we blindly believe the length of the
headers and block descriptors. Some devices return insane values for
these and cause our length to end up greater than the actual buffer
size, so check to make sure.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Also removed the buffer size magic number (512) and added DPOFUA of
zero to the defaults
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/char/sx.c')
0 files changed, 0 insertions, 0 deletions