Skip to content

Commit bb43628

Browse files
pskrgagwsakernel
authored andcommitted
i2c: validate user data in compat ioctl
Wrong user data may cause warning in i2c_transfer(), ex: zero msgs. Userspace should not be able to trigger warnings, so this patch adds validation checks for user data in compact ioctl to prevent reported warnings Reported-and-tested-by: syzbot+e417648b303855b91d8a@syzkaller.appspotmail.com Fixes: 7d5cb45 ("i2c compat ioctls: move to ->compat_ioctl()") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
1 parent fc74e0a commit bb43628

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

drivers/i2c/i2c-dev.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -535,6 +535,9 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo
535535
sizeof(rdwr_arg)))
536536
return -EFAULT;
537537

538+
if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)
539+
return -EINVAL;
540+
538541
if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
539542
return -EINVAL;
540543

0 commit comments

Comments
 (0)