From d8467e6f9d089324776cd1e449c2ddf11f595d98 Mon Sep 17 00:00:00 2001
From: Mark Lord <liml@rtr.ca>
Date: Thu, 15 Nov 2007 13:13:59 +0900
Subject: [PATCH] --- yaml --- r: 74044 b: refs/heads/master c:
 607126c2a21cd6e9bb807fdd415c1a992f7b9009 h: refs/heads/master v: v3

---
 [refs]                          | 2 +-
 trunk/drivers/ata/libata-scsi.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index ddf9f7d69b12..8016e3a1665e 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: f442cd86c1c86c5f44bc2cf23f89536f7e4cfe59
+refs/heads/master: 607126c2a21cd6e9bb807fdd415c1a992f7b9009
diff --git a/trunk/drivers/ata/libata-scsi.c b/trunk/drivers/ata/libata-scsi.c
index 94144ed50a6b..a45f6ac3b245 100644
--- a/trunk/drivers/ata/libata-scsi.c
+++ b/trunk/drivers/ata/libata-scsi.c
@@ -2869,7 +2869,8 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
 		xlat_func = NULL;
 		if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
 			/* relay SCSI command to ATAPI device */
-			if (unlikely(scmd->cmd_len > dev->cdb_len))
+			int len = COMMAND_SIZE(scsi_op);
+			if (unlikely(len > scmd->cmd_len || len > dev->cdb_len))
 				goto bad_cdb_len;
 
 			xlat_func = atapi_xlat;