Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

[karo-tx-linux.git] / drivers / scsi / sg.c

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 06503c10ea27801e039d80df4379602b68192aac..0a38ba01b7b4aac2151faf88421c8f2645dbd86a 100644 (file)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -582,7 +582,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
        sg_io_hdr_t *hp;
        unsigned char cmnd[SG_MAX_CDB_SIZE];
 
-       if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
+       if (unlikely(uaccess_kernel()))
                return -EINVAL;
 
        if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
@@ -1020,6 +1020,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                result = get_user(val, ip);
                if (result)
                        return result;
+               if (val > SG_MAX_CDB_SIZE)
+                       return -ENOMEM;
                sfp->next_cmd_len = (val > 0) ? val : 0;
                return 0;
        case SG_GET_VERSION_NUM:
@@ -1321,7 +1323,7 @@ sg_rq_end_io(struct request *rq, int uptodate)
                pr_info("%s: device detaching\n", __func__);
 
        sense = req->sense;
-       result = rq->errors;
+       result = req->result;
        resid = req->resid_len;
 
        SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sdp,
@@ -1739,7 +1741,7 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
 
        srp->rq = rq;
        rq->end_io_data = srp;
-       rq->retries = SG_DEFAULT_RETRIES;
+       req->retries = SG_DEFAULT_RETRIES;
 
        if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
                return 0;