---

yaml
---
r: 208415
b: refs/heads/master
c: 3094141
h: refs/heads/master
i:
  208413: 8835d6d
  208411: e9dbdc0
  208407: ec836bc
  208399: 85a65ed
  208383: 1622465
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a737b88df8d0b4476ae53daaa6db137df0541203
+refs/heads/master: 3094141c6532a4f748425c21c091001f218da8ae

trunk/drivers/scsi/sg.c

@@ -1686,14 +1686,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
 		int len, size = sizeof(struct sg_iovec) * iov_count;
 		struct iovec *iov;
 
-		iov = kmalloc(size, GFP_ATOMIC);
-		if (!iov)
-			return -ENOMEM;
-
-		if (copy_from_user(iov, hp->dxferp, size)) {
-			kfree(iov);
-			return -EFAULT;
-		}
+		iov = memdup_user(hp->dxferp, size);
+		if (IS_ERR(iov))
+			return PTR_ERR(iov);
 
 		len = iov_length(iov, iov_count);
 		if (hp->dxfer_len < len) {