diff options
Diffstat (limited to 'drivers/scsi/arcmsr/arcmsr_hba.c')
-rw-r--r-- | drivers/scsi/arcmsr/arcmsr_hba.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c index 2926295a936d..c9f87cdc85c1 100644 --- a/drivers/scsi/arcmsr/arcmsr_hba.c +++ b/drivers/scsi/arcmsr/arcmsr_hba.c | |||
@@ -2300,7 +2300,8 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, | |||
2300 | } | 2300 | } |
2301 | case ARCMSR_MESSAGE_WRITE_WQBUFFER: { | 2301 | case ARCMSR_MESSAGE_WRITE_WQBUFFER: { |
2302 | unsigned char *ver_addr; | 2302 | unsigned char *ver_addr; |
2303 | int32_t user_len, cnt2end; | 2303 | uint32_t user_len; |
2304 | int32_t cnt2end; | ||
2304 | uint8_t *pQbuffer, *ptmpuserbuffer; | 2305 | uint8_t *pQbuffer, *ptmpuserbuffer; |
2305 | ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC); | 2306 | ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC); |
2306 | if (!ver_addr) { | 2307 | if (!ver_addr) { |
@@ -2309,6 +2310,11 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, | |||
2309 | } | 2310 | } |
2310 | ptmpuserbuffer = ver_addr; | 2311 | ptmpuserbuffer = ver_addr; |
2311 | user_len = pcmdmessagefld->cmdmessage.Length; | 2312 | user_len = pcmdmessagefld->cmdmessage.Length; |
2313 | if (user_len > ARCMSR_API_DATA_BUFLEN) { | ||
2314 | retvalue = ARCMSR_MESSAGE_FAIL; | ||
2315 | kfree(ver_addr); | ||
2316 | goto message_out; | ||
2317 | } | ||
2312 | memcpy(ptmpuserbuffer, | 2318 | memcpy(ptmpuserbuffer, |
2313 | pcmdmessagefld->messagedatabuffer, user_len); | 2319 | pcmdmessagefld->messagedatabuffer, user_len); |
2314 | spin_lock_irqsave(&acb->wqbuffer_lock, flags); | 2320 | spin_lock_irqsave(&acb->wqbuffer_lock, flags); |