Patch "scsi: sg: check length passed to SG_NEXT_CMD_LEN" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

scsi: sg: check length passed to SG_NEXT_CMD_LEN

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
scsi-sg-check-length-passed-to-sg_next_cmd_len.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: peter chang <[email protected]>
Date: Wed, 15 Feb 2017 14:11:54 -0800
Subject: scsi: sg: check length passed to SG_NEXT_CMD_LEN

From: peter chang <[email protected]>

commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the value passed to the ioctl isn't checked against the usable max command size.

---
 drivers/scsi/sg.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -998,6 +998,8 @@ sg_ioctl(struct file *filp, unsigned int
 		result = get_user(val, ip);
 		if (result)
 			return result;
+		if (val > SG_MAX_CDB_SIZE)
+			return -ENOMEM;
 		sfp->next_cmd_len = (val > 0) ? val : 0;
 		return 0;
 	case SG_GET_VERSION_NUM:

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/scsi-sg-check-length-passed-to-sg_next_cmd_len.patch