releases/4.14.129/i2c-dev-fix-potential-memory-leak-in-i2cdev_ioctl_rd.patch

   1 From 199069d2e85cfdc8232124f3273d12b5d58d2d65 Mon Sep 17 00:00:00 2001
   2 From: Yingjoe Chen <yingjoe.chen@mediatek.com>
   3 Date: Tue, 7 May 2019 22:20:32 +0800
   4 Subject: i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
   5
   6 [ Upstream commit a0692f0eef91354b62c2b4c94954536536be5425 ]
   7
   8 If I2C_M_RECV_LEN check failed, msgs[i].buf allocated by memdup_user
   9 will not be freed. Pump index up so it will be freed.
  10
  11 Fixes: 838bfa6049fb ("i2c-dev: Add support for I2C_M_RECV_LEN")
  12 Signed-off-by: Yingjoe Chen <yingjoe.chen@mediatek.com>
  13 Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
  14 Signed-off-by: Sasha Levin <sashal@kernel.org>
  15 ---
  16  drivers/i2c/i2c-dev.c | 1 +
  17  1 file changed, 1 insertion(+)
  18
  19 diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
  20 index 00e8e675cbeb..eaa312bc3a3c 100644
  21 --- a/drivers/i2c/i2c-dev.c
  22 +++ b/drivers/i2c/i2c-dev.c
  23 @@ -297,6 +297,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
  24                             rdwr_pa[i].buf[0] < 1 ||
  25                             rdwr_pa[i].len < rdwr_pa[i].buf[0] +
  26                                              I2C_SMBUS_BLOCK_MAX) {
  27 +                               i++;
  28                                 res = -EINVAL;
  29                                 break;
  30                         }
  31 --
  32 2.20.1
  33