--- drivers/scsi/megaraid/megaraid_sas.c

+++ drivers/scsi/megaraid/megaraid_sas.c

@@ -3072,6 +3072,9 @@ megasas_mgmt_fw_ioctl(struct megasas_ins

* For each user buffer, create a mirror buffer and copy in

*/

for (i = 0; i < ioc->sge_count; i++) {

+ if (!ioc->sgl[i].iov_len)

+ continue;

+

kbuff_arr[i] = dma_alloc_coherent(&instance->pdev->dev,

ioc->sgl[i].iov_len,

&buf_handle, GFP_KERNEL);

@@ -3282,6 +3285,7 @@ static int megasas_mgmt_compat_ioctl_fw(

compat_alloc_user_space(sizeof(struct megasas_iocpacket));

int i;

int error = 0;

+ compat_uptr_t ptr;

if (clear_user(ioc, sizeof(*ioc)))

return -EFAULT;

@@ -3294,9 +3298,22 @@ static int megasas_mgmt_compat_ioctl_fw(

copy_in_user(&ioc->sge_count, &cioc->sge_count, sizeof(u32)))

return -EFAULT;

- for (i = 0; i < MAX_IOCTL_SGE; i++) {

- compat_uptr_t ptr;

+ /*

+ * The sense_ptr is used in megasas_mgmt_fw_ioctl only when

+ * sense_len is not null, so prepare the 64bit value under

+ * the same condition.

+ */

+ if (ioc->sense_len) {

+ void __user **sense_ioc_ptr =

+ (void __user **)(ioc->frame.raw + ioc->sense_off);

+ compat_uptr_t *sense_cioc_ptr =

+ (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);

+ if (get_user(ptr, sense_cioc_ptr) ||

+ put_user(compat_ptr(ptr), sense_ioc_ptr))

+ return -EFAULT;

+ }

+ for (i = 0; i < MAX_IOCTL_SGE; i++) {

if (get_user(ptr, &cioc->sgl[i].iov_base) ||

put_user(compat_ptr(ptr), &ioc->sgl[i].iov_base) ||

copy_in_user(&ioc->sgl[i].iov_len,