Merge tag 'v4.1.39' into 4.1-2.0.x-imx

Linux 4.1.39

* tag 'v4.1.39': (138 commits)
  Linux 4.1.39
  KVM: x86: remove data variable from kvm_get_msr_common
  KVM: VMX: Fix host initiated access to guest MSR_TSC_AUX
  KVM: x86: pass host_initiated to functions that read MSRs
  perf/core: Fix the perf_cpu_time_max_percent check
  perf/core: Make sysctl_perf_cpu_time_max_percent conform to documentation
  perf/core: Fix implicitly enable dynamic interrupt throttle
  perf/core: Fix dynamic interrupt throttle
  Fix missing sanity check in /dev/sg
  printk: use rcuidle console tracepoint
  vfs: fix uninitialized flags in splice_to_pipe()
  drm/radeon: Use mode h/vdisplay fields to hide out of bounds HW cursor
  ARM: 8658/1: uaccess: fix zeroing of 64-bit get_user()
  drm/dp/mst: fix kernel oops when turning off secondary monitor
  [media] siano: make it work again with CONFIG_VMAP_STACK
  mmc: core: fix multi-bit bus width without high-speed mode
  futex: Move futex_init() to core_initcall
  xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()
  scsi: aacraid: Fix INTx/MSI-x issue with older controllers
  cpumask: use nr_cpumask_bits for parsing functions
  ...

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>

1 files changed, 4 insertions, 0 deletions

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 26bc4e9c7441..0cc067ce5715 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1757,6 +1757,10 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
 			return res;
 
 		iov_iter_truncate(&i, hp->dxfer_len);
+		if (!iov_iter_count(&i)) {
+			kfree(iov);
+			return -EINVAL;
+		}
 
 		res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC);
 		kfree(iov);