Revision 40e05200593af06633f64ab0effff052eee6f076 authored by Mans Rullgard on 13 June 2020, 10:41:09 UTC, committed by Wolfram Sang on 26 June 2020, 08:18:35 UTC
If the i2c bus driver ignores the I2C_M_RECV_LEN flag (as some of
them do), it is possible for an I2C_SMBUS_BLOCK_DATA read issued
on some random device to return an arbitrary value in the first
byte (and nothing else). When this happens, i2c_smbus_xfer_emulated()
will happily write past the end of the supplied data buffer, thus
causing Bad Things to happen. To prevent this, check the size
before copying the data block and return an error if it is too large.
Fixes: 209d27c3b167 ("i2c: Emulate SMBus block read over I2C")
Signed-off-by: Mans Rullgard <mans@mansr.com>
[wsa: use better errno]
Signed-off-by: Wolfram Sang <wsa@kernel.org>
1 parent 502035e
| File | Mode | Size |
|---|---|---|
| 9p | ||
| adfs | ||
| affs | ||
| afs | ||
| autofs | ||
| befs | ||
| bfs | ||
| btrfs | ||
| cachefiles | ||
| ceph | ||
| cifs | ||
| coda | ||
| configfs | ||
| cramfs | ||
| crypto | ||
| debugfs | ||
| devpts | ||
| dlm | ||
| ecryptfs | ||
| efivarfs | ||
| efs | ||
| erofs | ||
| exfat | ||
| exportfs | ||
| ext2 | ||
| ext4 | ||
| f2fs | ||
| fat | ||
| freevxfs | ||
| fscache | ||
| fuse | ||
| gfs2 | ||
| hfs | ||
| hfsplus | ||
| hostfs | ||
| hpfs | ||
| hugetlbfs | ||
| iomap | ||
| isofs | ||
| jbd2 | ||
| jffs2 | ||
| jfs | ||
| kernfs | ||
| lockd | ||
| minix | ||
| nfs | ||
| nfs_common | ||
| nfsd | ||
| nilfs2 | ||
| nls | ||
| notify | ||
| ntfs | ||
| ocfs2 | ||
| omfs | ||
| openpromfs | ||
| orangefs | ||
| overlayfs | ||
| proc | ||
| pstore | ||
| qnx4 | ||
| qnx6 | ||
| quota | ||
| ramfs | ||
| reiserfs | ||
| romfs | ||
| squashfs | ||
| sysfs | ||
| sysv | ||
| tracefs | ||
| ubifs | ||
| udf | ||
| ufs | ||
| unicode | ||
| vboxsf | ||
| verity | ||
| xfs | ||
| zonefs | ||
| Kconfig | -rw-r--r-- | 7.7 KB |
| Kconfig.binfmt | -rw-r--r-- | 7.6 KB |
| Makefile | -rw-r--r-- | 4.5 KB |
| aio.c | -rw-r--r-- | 56.5 KB |
| anon_inodes.c | -rw-r--r-- | 4.6 KB |
| attr.c | -rw-r--r-- | 9.7 KB |
| bad_inode.c | -rw-r--r-- | 5.3 KB |
| binfmt_aout.c | -rw-r--r-- | 8.3 KB |
| binfmt_elf.c | -rw-r--r-- | 65.6 KB |
| binfmt_elf_fdpic.c | -rw-r--r-- | 47.2 KB |
| binfmt_em86.c | -rw-r--r-- | 2.7 KB |
| binfmt_flat.c | -rw-r--r-- | 28.1 KB |
| binfmt_misc.c | -rw-r--r-- | 17.3 KB |
| binfmt_script.c | -rw-r--r-- | 4.2 KB |
| block_dev.c | -rw-r--r-- | 56.7 KB |
| buffer.c | -rw-r--r-- | 89.6 KB |
| char_dev.c | -rw-r--r-- | 16.5 KB |
| compat.c | -rw-r--r-- | 3.2 KB |
| compat_binfmt_elf.c | -rw-r--r-- | 3.5 KB |
| coredump.c | -rw-r--r-- | 22.3 KB |
| d_path.c | -rw-r--r-- | 11.3 KB |
| dax.c | -rw-r--r-- | 45.7 KB |
| dcache.c | -rw-r--r-- | 84.4 KB |
| dcookies.c | -rw-r--r-- | 7.1 KB |
| direct-io.c | -rw-r--r-- | 40.1 KB |
| drop_caches.c | -rw-r--r-- | 1.8 KB |
| eventfd.c | -rw-r--r-- | 12.0 KB |
| eventpoll.c | -rw-r--r-- | 66.0 KB |
| exec.c | -rw-r--r-- | 49.2 KB |
| fcntl.c | -rw-r--r-- | 23.3 KB |
| fhandle.c | -rw-r--r-- | 6.8 KB |
| file.c | -rw-r--r-- | 24.7 KB |
| file_table.c | -rw-r--r-- | 10.2 KB |
| filesystems.c | -rw-r--r-- | 6.4 KB |
| fs-writeback.c | -rw-r--r-- | 74.6 KB |
| fs_context.c | -rw-r--r-- | 17.3 KB |
| fs_parser.c | -rw-r--r-- | 10.1 KB |
| fs_pin.c | -rw-r--r-- | 1.9 KB |
| fs_struct.c | -rw-r--r-- | 3.3 KB |
| fs_types.c | -rw-r--r-- | 2.5 KB |
| fsopen.c | -rw-r--r-- | 11.0 KB |
| inode.c | -rw-r--r-- | 63.0 KB |
| internal.h | -rw-r--r-- | 4.9 KB |
| io-wq.c | -rw-r--r-- | 27.2 KB |
| io-wq.h | -rw-r--r-- | 3.6 KB |
| io_uring.c | -rw-r--r-- | 193.6 KB |
| ioctl.c | -rw-r--r-- | 21.0 KB |
| libfs.c | -rw-r--r-- | 34.7 KB |
| locks.c | -rw-r--r-- | 79.8 KB |
| mbcache.c | -rw-r--r-- | 12.0 KB |
| mount.h | -rw-r--r-- | 4.2 KB |
| mpage.c | -rw-r--r-- | 20.5 KB |
| namei.c | -rw-r--r-- | 119.7 KB |
| namespace.c | -rw-r--r-- | 98.2 KB |
| no-block.c | -rw-r--r-- | 478 bytes |
| nsfs.c | -rw-r--r-- | 6.6 KB |
| open.c | -rw-r--r-- | 32.8 KB |
| pipe.c | -rw-r--r-- | 33.0 KB |
| pnode.c | -rw-r--r-- | 15.1 KB |
| pnode.h | -rw-r--r-- | 1.9 KB |
| posix_acl.c | -rw-r--r-- | 21.5 KB |
| proc_namespace.c | -rw-r--r-- | 7.9 KB |
| read_write.c | -rw-r--r-- | 52.7 KB |
| readdir.c | -rw-r--r-- | 13.9 KB |
| select.c | -rw-r--r-- | 34.5 KB |
| seq_file.c | -rw-r--r-- | 23.9 KB |
| signalfd.c | -rw-r--r-- | 9.0 KB |
| splice.c | -rw-r--r-- | 40.5 KB |
| stack.c | -rw-r--r-- | 2.5 KB |
| stat.c | -rw-r--r-- | 20.2 KB |
| statfs.c | -rw-r--r-- | 9.6 KB |
| super.c | -rw-r--r-- | 47.9 KB |
| sync.c | -rw-r--r-- | 10.5 KB |
| timerfd.c | -rw-r--r-- | 13.6 KB |
| userfaultfd.c | -rw-r--r-- | 52.6 KB |
| utimes.c | -rw-r--r-- | 7.4 KB |
| xattr.c | -rw-r--r-- | 23.7 KB |
Computing file changes ...
