ANDROID: scsi: Add segment checking in sg_read

Bug: 65023233 Signed-off-by: Roberto Pereira <[email protected]> Change-Id: Ib45f402cf304f9b8bf18884738f92b9c3db55573 Signed-off-by: Francisco Franco <[email protected]>
franciscofranco · May 11, 2018 · be30e09 · be30e09
1 parent f3dbf1c
commit be30e09
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
@@ -359,6 +359,9 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
 	struct sg_header *old_hdr = NULL;
 	int retval = 0;
 
+	if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
+		return -EINVAL;
+
 	if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 		return -ENXIO;
 	SCSI_LOG_TIMEOUT(3, printk("sg_read: %s, count=%d\n",