[PATCH v1 1/2] i2c: dev: check return value when calling dev_set_name()

[PATCH v1 1/2] i2c: dev: check return value when calling dev_set_name()

[Andy Shevchenko]

If dev_set_name() fails, the dev_name() is null, check the return
value of dev_set_name() to avoid the null-ptr-deref.

Fixes: 1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/i2c/i2c-dev.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index cf5d049342ea..6fd2b6718b08 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -668,16 +668,21 @@ static int i2cdev_attach_adapter(struct device *dev, void *dummy)
 	i2c_dev->dev.class = i2c_dev_class;
 	i2c_dev->dev.parent = &adap->dev;
 	i2c_dev->dev.release = i2cdev_dev_release;
-	dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr);
+
+	res = dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr);
+	if (res)
+		goto err_put_i2c_dev;
 
 	res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev);
-	if (res) {
-		put_i2c_dev(i2c_dev, false);
-		return res;
-	}
+	if (res)
+		goto err_put_i2c_dev;
 
 	pr_debug("adapter [%s] registered as minor %d\n", adap->name, adap->nr);
 	return 0;
+
+err_put_i2c_dev:
+	put_i2c_dev(i2c_dev, false);
+	return res;
 }
 
 static int i2cdev_detach_adapter(struct device *dev, void *dummy)
-- 
2.35.1

[PATCH v1 2/2] i2c: dev: Force case user pointers in compat_i2cdev_ioctl()

[Andy Shevchenko]

Sparse has warned us about wrong address space for user pointers:

  i2c-dev.c:561:50: warning: incorrect type in initializer (different address spaces)
  i2c-dev.c:561:50:    expected unsigned char [usertype] *buf
  i2c-dev.c:561:50:    got void [noderef] __user *

Force cast the pointer to (__u8 *) that is used by I²C core code.

Note, this is an additional fix to the previously addressed similar issue
in the I2C_RDWR case in the same function.

Fixes: 3265a7e6b41b ("i2c: dev: Add __user annotation")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/i2c/i2c-dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 6fd2b6718b08..ab0adaa130da 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -557,7 +557,7 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo
 				.addr = umsg.addr,
 				.flags = umsg.flags,
 				.len = umsg.len,
-				.buf = compat_ptr(umsg.buf)
+				.buf = (__force __u8 *)compat_ptr(umsg.buf),
 			};
 		}
 
-- 
2.35.1

Re: [PATCH v1 2/2] i2c: dev: Force case user pointers in compat_i2cdev_ioctl()

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 718 bytes --]

On Mon, Apr 11, 2022 at 09:07:52PM +0300, Andy Shevchenko wrote:
> Sparse has warned us about wrong address space for user pointers:
> 
>   i2c-dev.c:561:50: warning: incorrect type in initializer (different address spaces)
>   i2c-dev.c:561:50:    expected unsigned char [usertype] *buf
>   i2c-dev.c:561:50:    got void [noderef] __user *
> 
> Force cast the pointer to (__u8 *) that is used by I²C core code.
> 
> Note, this is an additional fix to the previously addressed similar issue
> in the I2C_RDWR case in the same function.
> 
> Fixes: 3265a7e6b41b ("i2c: dev: Add __user annotation")
> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

Applied to for-current, thanks!


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v1 1/2] i2c: dev: check return value when calling dev_set_name()

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 392 bytes --]

On Mon, Apr 11, 2022 at 09:07:51PM +0300, Andy Shevchenko wrote:
> If dev_set_name() fails, the dev_name() is null, check the return
> value of dev_set_name() to avoid the null-ptr-deref.
> 
> Fixes: 1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev")
> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

Applied to for-current, thanks!


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]