From: Jean Delvare <khali@linux-fr.org>
To: Marcelo Tosatti <marcelo@conectiva.com.br>
Cc: sensors@Stimpy.netroedge.com, linux-kernel@vger.kernel.org,
vsu@altlinux.ru, rtjohnso@eecs.berkeley.edu, greg@kroah.com
Subject: Re: [PATCH 2.4] i2c-dev user/kernel bug and mem leak
Date: Wed, 6 Aug 2003 10:07:02 +0200 [thread overview]
Message-ID: <20030806100702.78298ffe.khali@linux-fr.org> (raw)
In-Reply-To: <20030805210704.GA5452@kroah.com>
Hi Marcelo,
Greg> Patch looks good, want to send it to Marcelo, or do you want me
Greg> to?
Here I do, speaking in the name of the I2C & LM Sensors development team
:)
A patch to i2c-dev follows, built against 2.4.22-pre10, which brings
the following changes:
* Fix a user/kernel bug discovered by Robert T. Johnson.
Patch by Sergey Vlasov.
* Fix a memory leak discovered by Robert T. Johnson.
Patch by Sergey Vlasov and me.
* Two code optimizations/cleanups.
Patches by Sergey Vlaslov and me, respectively.
* Bonus: two lines with changed whitespace, but you don't care.
Patches by me and Robert T. Johnson, respectively.
These changes should also be made to i2c-CVS and Linux 2.6's i2c
subsystem. I will commit the changes to i2c-CVS while Greg KH will
submit a modified patch to Linus.
The final patch was tested by me (compiles and runs with no apparent
drawback) and approved by Sergey Vlaslov and Greg KH.
Please apply.
Thanks,
Jean
--- 2.4/drivers/i2c/i2c-dev.c Tue Jul 15 12:23:49 2003
+++ 2.4/drivers/i2c/i2c-dev.c Wed Aug 6 09:36:54 2003
@@ -219,6 +219,7 @@
struct i2c_smbus_ioctl_data data_arg;
union i2c_smbus_data temp;
struct i2c_msg *rdwr_pa;
+ u8 **data_ptrs;
int i,datasize,res;
unsigned long funcs;
@@ -248,7 +249,7 @@
return (copy_to_user((unsigned long *)arg,&funcs,
sizeof(unsigned long)))?-EFAULT:0;
- case I2C_RDWR:
+ case I2C_RDWR:
if (copy_from_user(&rdwr_arg,
(struct i2c_rdwr_ioctl_data *)arg,
sizeof(rdwr_arg)))
@@ -265,21 +266,28 @@
if (rdwr_pa == NULL) return -ENOMEM;
+ if (copy_from_user(rdwr_pa, rdwr_arg.msgs,
+ rdwr_arg.nmsgs * sizeof(struct i2c_msg))) {
+ kfree(rdwr_pa);
+ return -EFAULT;
+ }
+
+ data_ptrs = (u8 **) kmalloc(rdwr_arg.nmsgs * sizeof(u8 *),
+ GFP_KERNEL);
+ if (data_ptrs == NULL) {
+ kfree(rdwr_pa);
+ return -ENOMEM;
+ }
+
res = 0;
for( i=0; i<rdwr_arg.nmsgs; i++ )
{
- if(copy_from_user(&(rdwr_pa[i]),
- &(rdwr_arg.msgs[i]),
- sizeof(rdwr_pa[i])))
- {
- res = -EFAULT;
- break;
- }
/* Limit the size of the message to a sane amount */
if (rdwr_pa[i].len > 8192) {
res = -EINVAL;
break;
}
+ data_ptrs[i] = rdwr_pa[i].buf;
rdwr_pa[i].buf = kmalloc(rdwr_pa[i].len, GFP_KERNEL);
if(rdwr_pa[i].buf == NULL)
{
@@ -287,10 +295,11 @@
break;
}
if(copy_from_user(rdwr_pa[i].buf,
- rdwr_arg.msgs[i].buf,
+ data_ptrs[i],
rdwr_pa[i].len))
{
- res = -EFAULT;
+ ++i; /* Needs to be kfreed too */
+ res = -EFAULT;
break;
}
}
@@ -298,21 +307,20 @@
int j;
for (j = 0; j < i; ++j)
kfree(rdwr_pa[j].buf);
+ kfree(data_ptrs);
kfree(rdwr_pa);
return res;
}
- if (!res)
- {
- res = i2c_transfer(client->adapter,
- rdwr_pa,
- rdwr_arg.nmsgs);
- }
+
+ res = i2c_transfer(client->adapter,
+ rdwr_pa,
+ rdwr_arg.nmsgs);
while(i-- > 0)
{
if( res>=0 && (rdwr_pa[i].flags & I2C_M_RD))
{
if(copy_to_user(
- rdwr_arg.msgs[i].buf,
+ data_ptrs[i],
rdwr_pa[i].buf,
rdwr_pa[i].len))
{
@@ -321,6 +329,7 @@
}
kfree(rdwr_pa[i].buf);
}
+ kfree(data_ptrs);
kfree(rdwr_pa);
return res;
--
Jean Delvare
http://www.ensicaen.ismra.fr/~delvare/
next prev parent reply other threads:[~2003-08-06 8:07 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-08-03 17:23 PATCH: 2.4.22-pre7 drivers/i2c/i2c-dev.c user/kernel bug and mem leak Jean Delvare
2003-08-04 15:32 ` Sergey Vlasov
2003-08-05 8:32 ` Jean Delvare
2003-08-05 14:10 ` Sergey Vlasov
2003-08-05 21:07 ` Greg KH
2003-08-06 8:07 ` Jean Delvare [this message]
[not found] ` <1060886657.1006.7121.camel@dooby.cs.berkeley.edu>
[not found] ` <20030814190954.GA2492@kroah.com>
2003-08-15 2:01 ` [PATCH 2.4] i2c-dev " Robert T. Johnson
2003-08-15 21:13 ` Greg KH
2003-08-15 22:17 ` Robert T. Johnson
2003-08-15 23:51 ` Greg KH
2003-08-18 0:54 ` Robert T. Johnson
2003-08-18 21:05 ` Greg KH
2003-09-10 23:02 ` CQual 0.99 Released: user/kernel pointer bug finding tool Robert T. Johnson
2003-08-28 1:17 ` [PATCH 2.4] i2c-dev user/kernel bug and mem leak Robert T. Johnson
2003-08-29 16:21 ` Jean Delvare
2003-08-29 17:30 ` Robert T. Johnson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030806100702.78298ffe.khali@linux-fr.org \
--to=khali@linux-fr.org \
--cc=greg@kroah.com \
--cc=linux-kernel@vger.kernel.org \
--cc=marcelo@conectiva.com.br \
--cc=rtjohnso@eecs.berkeley.edu \
--cc=sensors@Stimpy.netroedge.com \
--cc=vsu@altlinux.ru \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).