kernel/linux.git/drivers/i2c/i2c-dev.c, branch v6.1.168

i2c: dev: copy userspace array safely

2023-11-28T17:07:02+00:00

[ Upstream commit cc9c54232f04aef3a5d7f64a0ece7df00f1aaa3d ] i2c-dev.c utilizes memdup_user() to copy a userspace array. This is done without an overflow check. Use the new wrapper memdup_array_user() to copy the array more safely. Suggested-by: Dave Airlie Signed-off-by: Philipp Stanner Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin

i2c: dev: Force case user pointers in compat_i2cdev_ioctl()

2022-04-15T21:30:59+00:00

Sparse has warned us about wrong address space for user pointers: i2c-dev.c:561:50: warning: incorrect type in initializer (different address spaces) i2c-dev.c:561:50: expected unsigned char [usertype] *buf i2c-dev.c:561:50: got void [noderef] __user * Force cast the pointer to (__u8 *) that is used by I²C core code. Note, this is an additional fix to the previously addressed similar issue in the I2C_RDWR case in the same function. Fixes: 3265a7e6b41b ("i2c: dev: Add __user annotation") Signed-off-by: Andy Shevchenko Signed-off-by: Wolfram Sang

i2c: dev: check return value when calling dev_set_name()

2022-04-15T21:23:22+00:00

If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref. Fixes: 1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev") Signed-off-by: Andy Shevchenko Signed-off-by: Wolfram Sang

i2c: validate user data in compat ioctl

2021-12-31T13:28:22+00:00

Wrong user data may cause warning in i2c_transfer(), ex: zero msgs. Userspace should not be able to trigger warnings, so this patch adds validation checks for user data in compact ioctl to prevent reported warnings Reported-and-tested-by: syzbot+e417648b303855b91d8a@syzkaller.appspotmail.com Fixes: 7d5cb45655f2 ("i2c compat ioctls: move to ->compat_ioctl()") Signed-off-by: Pavel Skripkin Signed-off-by: Wolfram Sang

Merge branch 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

2021-08-31T21:34:01+00:00

Pull i2c updates from Wolfram Sang: "I2C has a smaller pull reuest this time: - new driver for I2C virtio - removal of PMC SMP driver because platform is already gone - IRQ probing and DMAENGINE API cleanups - add SI metric prefix definitions to units.h - beginning of i801 refactorization - a few driver improvements" * 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (28 commits) i2c: cadence: Implement save restore i2c: xlp9xx: fix main IRQ check i2c: mt65xx: fix IRQ check i2c: virtio: add a virtio i2c frontend driver i2c: hix5hd2: fix IRQ check i2c: s3c2410: fix IRQ check i2c: iop3xx: fix deferred probing i2c: synquacer: fix deferred probing i2c: sun6i-pw2i: Prefer strscpy over strlcpy i2c: remove dead PMC MSP TWI/SMBus/I2C driver i2c: dev: Use sysfs_emit() in "show" functions i2c: dev: Define pr_fmt() and drop duplication substrings i2c: designware: Fix indentation in the header i2c: designware: Use DIV_ROUND_CLOSEST() macro units: Add SI metric prefix definitions i2c: at91: mark PM ops as __maybe unused i2c: sh_mobile: : use proper DMAENGINE API for termination i2c: qup: : use proper DMAENGINE API for termination i2c: mxs: : use proper DMAENGINE API for termination i2c: imx: : use proper DMAENGINE API for termination ...

i2c: dev: Use sysfs_emit() in "show" functions

2021-08-11T14:48:51+00:00

The sysfs_emit() function was introduced to make it less ambiguous which function is preferred when writing to the output buffer in a "show" callback [1]. Convert the I²C device sysfs interface from sprintf() to sysfs_emit() accordingly, as the latter is aware of the PAGE_SIZE buffer and correctly returns the number of bytes written into the buffer. No functional change intended. [1] Documentation/filesystems/sysfs.rst Signed-off-by: Andy Shevchenko Signed-off-by: Wolfram Sang

i2c: dev: Define pr_fmt() and drop duplication substrings

2021-08-11T14:46:41+00:00

Define pr_fmt() to print module name as prefix and at the same time drop duplication substrings in the messages. While at it, convert printk() to pr_(). Signed-off-by: Andy Shevchenko Signed-off-by: Wolfram Sang

i2c: dev: zero out array used for i2c reads from userspace

2021-08-10T20:54:10+00:00

If an i2c driver happens to not provide the full amount of data that a user asks for, it is possible that some uninitialized data could be sent to userspace. While all in-kernel drivers look to be safe, just be sure by initializing the buffer to zero before it is passed to the i2c driver so that any future drivers will not have this issue. Also properly copy the amount of data recvieved to the userspace buffer, as pointed out by Dan Carpenter. Reported-by: Eric Dumazet Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Wolfram Sang

i2c: dev: Add __user annotation

2021-06-24T19:47:43+00:00

Fix Sparse warnings: drivers/i2c/i2c-dev.c:546:19: warning: incorrect type in assignment (different address spaces) drivers/i2c/i2c-dev.c:549:53: warning: incorrect type in argument 2 (different address spaces) compat_ptr() returns a pointer tagged __user which gets assigned to a pointer missing the __user annotation. The same pointer is passed to copy_from_user() as an argument where it is expected to have the __user annotation. Fix both by adding the __user annotation to the pointer. Fixes: 7d5cb45655f2 ("i2c compat ioctls: move to ->compat_ioctl()") Signed-off-by: Andreas Hecht Signed-off-by: Wolfram Sang

i2c: bail out early when RDWR parameters are wrong

2021-03-18T11:15:29+00:00

The buggy parameters currently get caught later, but emit a noisy WARN. Userspace should not be able to trigger this, so add similar checks much earlier. Also avoids some unneeded code paths, of course. Apply kernel coding stlye to a comment while here. Reported-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com Tested-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang