mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
i2c-dev: Reject I2C_M_RECV_LEN
The I2C_M_RECV_LEN calling convention for i2c_mesg.flags involves playing games with reported buffer lengths. (They start out less than their actual size, and the length is then modified to reflect how many bytes were delivered ... which one hopes is less than the presumed actual size.) Refuse to play such error prone games across the boundary between userspace and kernel. Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
This commit is contained in:
parent
9d90c1fd9b
commit
e265cfa19c
1 changed files with 4 additions and 2 deletions
|
@ -226,8 +226,10 @@ static int i2cdev_ioctl(struct inode *inode, struct file *file,
|
|||
|
||||
res = 0;
|
||||
for( i=0; i<rdwr_arg.nmsgs; i++ ) {
|
||||
/* Limit the size of the message to a sane amount */
|
||||
if (rdwr_pa[i].len > 8192) {
|
||||
/* Limit the size of the message to a sane amount;
|
||||
* and don't let length change either. */
|
||||
if ((rdwr_pa[i].len > 8192) ||
|
||||
(rdwr_pa[i].flags & I2C_M_RECV_LEN)) {
|
||||
res = -EINVAL;
|
||||
break;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue