Changeset 4947

Show
Ignore:
Timestamp:
10/14/07 12:32:52 (1 year ago)
Author:
khali
Message:

Let i2c-dev reject I2C_M_RECV_LEN. This is a backport from Linux 2.6,
original patch from David Brownell:

The I2C_M_RECV_LEN calling convention for i2c_mesg.flags involves
playing games with reported buffer lengths. (They start out less
than their actual size, and the length is then modified to reflect
how many bytes were delivered ... which one hopes is less than the
presumed actual size.) Refuse to play such error prone games across
the boundary between userspace and kernel.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • i2c/trunk/CHANGES

    r4620 r4947  
    1010SVN HEAD 
    1111  i2c-algo-bit: Always send a stop condition before leaving (2.6 backport) 
     12  i2c-dev: Reject I2C_M_RECV_LEN (2.6 backport) 
    1213 
    1314 

  • i2c/trunk/kernel/i2c-dev.c

    r4023 r4947  
    236236                for( i=0; i<rdwr_arg.nmsgs; i++ ) 
    237237                { 
    238                         /* Limit the size of the message to a sane amount */ 
    239                         if (rdwr_pa[i].len > 8192) { 
     238                        /* Limit the size of the message to a sane amount; 
     239                         * and don't let length change either. */ 
     240                        if ((rdwr_pa[i].len > 8192) || 
     241                            (rdwr_pa[i].flags & I2C_M_RECV_LEN)) { 
    240242                                res = -EINVAL; 
    241243                                break;