[SCSI] gdth: integer overflow in ioctl

[mv-sheeva.git] / drivers / scsi / gdth.c

diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 5a3f93101017b601fe98b2bbf12d9b55fd27152b..841101846b88fe98e55a6c601b013ef9119cdf4a 100644 (file)
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -4177,6 +4177,14 @@ static int ioc_general(void __user *arg, char *cmnd)
     ha = gdth_find_ha(gen.ionode);
     if (!ha)
         return -EFAULT;
+
+    if (gen.data_len > INT_MAX)
+        return -EINVAL;
+    if (gen.sense_len > INT_MAX)
+        return -EINVAL;
+    if (gen.data_len + gen.sense_len > INT_MAX)
+        return -EINVAL;
+
     if (gen.data_len + gen.sense_len != 0) {
         if (!(buf = gdth_ioctl_alloc(ha, gen.data_len + gen.sense_len,
                                      FALSE, &paddr)))