Re: [PATCH next] scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd()

Jens Axboe
2026-04-10T12:41:51Z

On Fri, 10 Apr 2026 13:14:52 +0300, Dan Carpenter wrote:
> The bounds checking in scsi_bsg_uring_cmd() does not work because
> cmd->request_len is a u32 and scmd->cmd_len is a u16. We check that
> scmd->cmd_len is valid but if the cmd->request_len is more than
> USHRT_MAX it would still lead to a buffer overflow when we do the
> copy_from_user().
>
>
> [...]

Applied, thanks!

[1/1] scsi: bsg: fix buffer overflow in scsi_bsg_uring_cmd()
commit: 0a42ca4d2bff6306dd574a7897258fd02c2e6930

Best regards,
--
Jens Axboe