Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e265cfa19c1220938de5f0291ed8d549a523de3c
Commit: e265cfa19c1220938de5f0291ed8d549a523de3c
Parent: 9d90c1fd9bdbffb456d1b1ef05215343503fd0b0
Author: David Brownell <[EMAIL PROTECTED]>
AuthorDate: Sat Oct 13 23:56:31 2007 +0200
Committer: Jean Delvare <[EMAIL PROTECTED]>
CommitDate: Sat Oct 13 23:56:31 2007 +0200
i2c-dev: Reject I2C_M_RECV_LEN
The I2C_M_RECV_LEN calling convention for i2c_mesg.flags involves
playing games with reported buffer lengths. (They start out less
than their actual size, and the length is then modified to reflect
how many bytes were delivered ... which one hopes is less than the
presumed actual size.) Refuse to play such error prone games across
the boundary between userspace and kernel.
Signed-off-by: David Brownell <[EMAIL PROTECTED]>
Signed-off-by: Jean Delvare <[EMAIL PROTECTED]>
---
drivers/i2c/i2c-dev.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 64eee95..df6e14c 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -226,8 +226,10 @@ static int i2cdev_ioctl(struct inode *inode, struct file
*file,
res = 0;
for( i=0; i<rdwr_arg.nmsgs; i++ ) {
- /* Limit the size of the message to a sane amount */
- if (rdwr_pa[i].len > 8192) {
+ /* Limit the size of the message to a sane amount;
+ * and don't let length change either. */
+ if ((rdwr_pa[i].len > 8192) ||
+ (rdwr_pa[i].flags & I2C_M_RECV_LEN)) {
res = -EINVAL;
break;
}
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
