* [PATCH] i2c: bail out early when RDWR parameters are wrong
@ 2021-03-12 11:57 Wolfram Sang
2021-03-18 11:15 ` Wolfram Sang
0 siblings, 1 reply; 2+ messages in thread
From: Wolfram Sang @ 2021-03-12 11:57 UTC (permalink / raw)
To: linux-i2c; +Cc: Wolfram Sang, syzbot+ffb0b3ffa6cfbc7d7b3f
The buggy parameters currently get caught later, but emit a noisy WARN.
Userspace should not be able to trigger this, so add similar checks much
earlier. Also avoids some unneeded code paths, of course. Apply kernel
coding stlye to a comment while here.
Reported-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com
Tested-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
---
drivers/i2c/i2c-dev.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 6ceb11cc4be1..6ef38a8ee95c 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -440,8 +440,13 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
sizeof(rdwr_arg)))
return -EFAULT;
- /* Put an arbitrary limit on the number of messages that can
- * be sent at once */
+ if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)
+ return -EINVAL;
+
+ /*
+ * Put an arbitrary limit on the number of messages that can
+ * be sent at once
+ */
if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
return -EINVAL;
--
2.30.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] i2c: bail out early when RDWR parameters are wrong
2021-03-12 11:57 [PATCH] i2c: bail out early when RDWR parameters are wrong Wolfram Sang
@ 2021-03-18 11:15 ` Wolfram Sang
0 siblings, 0 replies; 2+ messages in thread
From: Wolfram Sang @ 2021-03-18 11:15 UTC (permalink / raw)
To: linux-i2c; +Cc: syzbot+ffb0b3ffa6cfbc7d7b3f
[-- Attachment #1: Type: text/plain, Size: 571 bytes --]
On Fri, Mar 12, 2021 at 12:57:34PM +0100, Wolfram Sang wrote:
> The buggy parameters currently get caught later, but emit a noisy WARN.
> Userspace should not be able to trigger this, so add similar checks much
> earlier. Also avoids some unneeded code paths, of course. Apply kernel
> coding stlye to a comment while here.
>
> Reported-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com
> Tested-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com
> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Applied to for-next, thanks!
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-03-18 11:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-12 11:57 [PATCH] i2c: bail out early when RDWR parameters are wrong Wolfram Sang
2021-03-18 11:15 ` Wolfram Sang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).