[PATCH] scsi_ioctl memcpy'ing user address

James reported a bug in scsi_ioctl.c where it mem copies a user pointer
instead of using copy_from_user(). I inadvertently introduced this one
when getting rid of CDROM_SEND_PACKET. Here's a trivial patch to fix it.

drivers/block/scsi_ioctl.c

@@ -216,7 +216,12 @@ static int sg_io(request_queue_t *q, struct block_device *bdev,
 	 * fill in request structure
 	 */
 	rq->cmd_len = hdr->cmd_len;
-	memcpy(rq->cmd, hdr->cmdp, hdr->cmd_len);
+
+	if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len)) {
+		blk_put_request(rq);
+		return -EFAULT;
+	}
+
 	if (sizeof(rq->cmd) != hdr->cmd_len)
 		memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len);