kernel/linux.git/drivers/i2c/i2c-dev.c, branch v4.17.1

i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr()

2018-04-27T12:04:10+00:00

i2cdev_ioctl_rdwr() allocates i2c_msg.buf using memdup_user(), which returns ZERO_SIZE_PTR if i2c_msg.len is zero. Currently i2cdev_ioctl_rdwr() always dereferences the buf pointer in case of I2C_M_RD | I2C_M_RECV_LEN transfer. That causes a kernel oops in case of zero len. Let's check the len against zero before dereferencing buf pointer. This issue was triggered by syzkaller. Signed-off-by: Alexander Popov Reviewed-by: Uwe Kleine-König [wsa: use '< 1' instead of '!' for easier readability] Signed-off-by: Wolfram Sang

i2c: dev: mark RDWR buffers as DMA_SAFE

2017-12-03T20:19:32+00:00

Reviewed-by: Jonathan Cameron Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang

i2c compat ioctls: move to ->compat_ioctl()

2017-09-20T05:02:27+00:00

Signed-off-by: Al Viro

i2c: fix kernel memory disclosure in dev interface

2017-01-12T19:06:10+00:00

i2c_smbus_xfer() does not always fill an entire block, allowing kernel stack memory disclosure through the temp variable. Clear it before it's read to. Signed-off-by: Vlad Tsyrklevich Signed-off-by: Wolfram Sang Cc: stable@kernel.org

i2c-dev: don't get i2c adapter via i2c_dev

2016-07-08T01:29:31+00:00

There is no code protecting i2c_dev to be freed after it is returned from i2c_dev_get_by_minor() and using it to access the value which we already have (minor) isn't safe really. Avoid using it and get the adapter directly from 'minor'. Signed-off-by: Viresh Kumar Reviewed-by: Jean Delvare Tested-by: Jean Delvare Signed-off-by: Wolfram Sang

i2c: dev: use after free in detach

2016-05-28T15:37:42+00:00

The call to put_i2c_dev() frees "i2c_dev" so there is a use after free when we call cdev_del(&i2c_dev->cdev). Fixes: d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API') Signed-off-by: Dan Carpenter Signed-off-by: Wolfram Sang

i2c: dev: don't start function name with 'return'

2016-05-27T11:13:01+00:00

I stumbled multiple times over 'return_i2c_dev', especially before the actual 'return res'. It makes the code hard to read, so reanme the function to 'put_i2c_dev' which also better matches 'get_free_i2c_dev'. Signed-off-by: Wolfram Sang

i2c: dev: switch from register_chrdev to cdev API

2016-05-26T19:18:57+00:00

i2c-dev had never moved away from the older register_chrdev interface to implement its char device registration. The register_chrdev API has the limitation of enabling only up to 256 i2c-dev busses to exist. Large platforms with lots of i2c devices (i.e. pluggable transceivers) with dedicated busses may have to exceed that limit. In particular, there are also platforms making use of the i2c bus multiplexing API, which instantiates a virtual bus for each possible multiplexed selection. This patch removes the register_chrdev usage and replaces it with the less old cdev API, which takes away the 256 i2c-dev bus limitation. It should not have any other impact for i2c bus drivers or user space. This patch has been tested on qemu x86 and qemu powerpc platforms with the aid of a module which adds and removes 5000 virtual i2c busses, as well as validated on an existing powerpc hardware platform which makes use of the i2c bus multiplexing API. i2c-dev busses with device minor numbers larger than 256 have also been validated to work with the existing i2c-tools. Signed-off-by: Erico Nunes [wsa: kept includes sorted] Signed-off-by: Wolfram Sang

i2c: i2c-dev: sort includes

2016-02-20T22:33:38+00:00

I request this for drivers, so the core should adhere to sorted includes as well. Signed-off-by: Wolfram Sang

i2c-dev: Fix I2C_SLAVE ioctl comment

2015-10-23T21:26:44+00:00

The first part of the comment is wrong since November 2007, delete it. The second part of the comment is related to I2C_PEC, not I2C_SLAVE, so move it where it belongs. Signed-off-by: Jean Delvare Cc: Wolfram Sang Signed-off-by: Wolfram Sang