projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| a15a8890 SL |
1 | From af1ba071f1aa41455c378847324fcdd1b7840f54 Mon Sep 17 00:00:00 2001 |
| 2 | From: Yingjoe Chen <yingjoe.chen@mediatek.com> | |
| 3 | Date: Tue, 7 May 2019 22:20:32 +0800 | |
| 4 | Subject: i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr | |
| 5 | ||
| 6 | [ Upstream commit a0692f0eef91354b62c2b4c94954536536be5425 ] | |
| 7 | ||
| 8 | If I2C_M_RECV_LEN check failed, msgs[i].buf allocated by memdup_user | |
| 9 | will not be freed. Pump index up so it will be freed. | |
| 10 | ||
| 11 | Fixes: 838bfa6049fb ("i2c-dev: Add support for I2C_M_RECV_LEN") | |
| 12 | Signed-off-by: Yingjoe Chen <yingjoe.chen@mediatek.com> | |
| 13 | Signed-off-by: Wolfram Sang <wsa@the-dreams.de> | |
| 14 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
| 15 | --- | |
| 16 | drivers/i2c/i2c-dev.c | 1 + | |
| 17 | 1 file changed, 1 insertion(+) | |
| 18 | ||
| 19 | diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c | |
| 20 | index ccd76c71af09..cb07651f4b46 100644 | |
| 21 | --- a/drivers/i2c/i2c-dev.c | |
| 22 | +++ b/drivers/i2c/i2c-dev.c | |
| 23 | @@ -283,6 +283,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client, | |
| 24 | msgs[i].len < 1 || msgs[i].buf[0] < 1 || | |
| 25 | msgs[i].len < msgs[i].buf[0] + | |
| 26 | I2C_SMBUS_BLOCK_MAX) { | |
| 27 | + i++; | |
| 28 | res = -EINVAL; | |
| 29 | break; | |
| 30 | } | |
| 31 | -- | |
| 32 | 2.20.1 | |
| 33 |