linux-stable.git/drivers/i2c/i2c-dev.c, branch v4.4.185

i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr

2019-06-22T06:18:26+00:00

[ Upstream commit a0692f0eef91354b62c2b4c94954536536be5425 ]

If I2C_M_RECV_LEN check failed, msgs[i].buf allocated by memdup_user
will not be freed. Pump index up so it will be freed.

Fixes: 838bfa6049fb ("i2c-dev: Add support for I2C_M_RECV_LEN")
Signed-off-by: Yingjoe Chen 
Signed-off-by: Wolfram Sang 
Signed-off-by: Sasha Levin

i2c: dev: prevent adapter retries and timeout being set as minus value

2019-01-16T21:16:12+00:00

commit 6ebec961d59bccf65d08b13fc1ad4e6272a89338 upstream.

If adapter->retries is set to a minus value from user space via ioctl,
it will make __i2c_transfer and __i2c_smbus_xfer skip the calling to
adapter->algo->master_xfer and adapter->algo->smbus_xfer that is
registered by the underlying bus drivers, and return value 0 to all the
callers. The bus driver will never be accessed anymore by all users,
besides, the users may still get successful return value without any
error or information log print out.

If adapter->timeout is set to minus value from user space via ioctl,
it will make the retrying loop in __i2c_transfer and __i2c_smbus_xfer
always break after the the first try, due to the time_after always
returns true.

Signed-off-by: Yi Zeng 
[wsa: minor grammar updates to commit message]
Signed-off-by: Wolfram Sang 
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman

i2c: fix kernel memory disclosure in dev interface

2017-01-19T19:17:20+00:00

commit 30f939feaeee23e21391cfc7b484f012eb189c3c upstream.

i2c_smbus_xfer() does not always fill an entire block, allowing
kernel stack memory disclosure through the temp variable. Clear
it before it's read to.

Signed-off-by: Vlad Tsyrklevich 
Signed-off-by: Wolfram Sang 
Signed-off-by: Greg Kroah-Hartman

i2c-dev: Fix I2C_SLAVE ioctl comment

2015-10-23T21:26:44+00:00

The first part of the comment is wrong since November 2007, delete it.

The second part of the comment is related to I2C_PEC, not I2C_SLAVE, so
move it where it belongs.

Signed-off-by: Jean Delvare 
Cc: Wolfram Sang 
Signed-off-by: Wolfram Sang

i2c-dev: Fix typo in ioctl name reference

2015-10-23T21:26:43+00:00

The ioctl is named I2C_RDWR for "I2C read/write". But references to it
were misspelled "rdrw". Fix them.

Signed-off-by: Jean Delvare 
Signed-off-by: Wolfram Sang

i2c: remove FSF address

2014-11-07T17:35:33+00:00

We have a central copy of the GPL for that. Some addresses were already
outdated.

Signed-off-by: Wolfram Sang

i2c: i2c-dev: Create 'name' attribute automatically

2013-09-30T04:02:31+00:00

The 'name' attribute is needed for all i2c-dev class devices, meaning
it can be created automatically by pointing to it in the class data
structure. This simplifies the code and reduces the probability for race
conditions (the name attribute should exist by the time the device is
announced to user space).

Signed-off-by: Guenter Roeck 
Signed-off-by: Wolfram Sang

new helper: file_inode(file)

2013-02-23T04:31:31+00:00

Signed-off-by: Al Viro

i2c-dev: Add support for I2C_M_RECV_LEN

2012-05-30T08:55:34+00:00

As the bus driver side implementation of I2C_M_RECV_LEN is heavily
tied to SMBus, we can't support received length over 32 bytes, but
let's at least support that.

In practice, the caller will have to setup a buffer large enough to
cover the case where received length byte has value 32, so minimum
32 + 1 = 33 bytes, possibly more if there is a fixed number of bytes
added for the specific slave (for example a checksum.)

Signed-off-by: Jean Delvare 
Tested-by: Douglas Gilbert

i2c: Update the FSF address

2012-03-26T19:47:19+00:00

Signed-off-by: Jean Delvare