Commit cc9c5423 authored Nov 02, 2023 by Philipp Stanner Committed by Wolfram Sang Nov 08, 2023

i2c: dev: copy userspace array safely



i2c-dev.c utilizes memdup_user() to copy a userspace array. This is done
without an overflow check.

Use the new wrapper memdup_array_user() to copy the array more safely.

Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>

parent e8183fa1

drivers/i2c/i2c-dev.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -450,8 +450,8 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
		if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
		return -EINVAL;

		rdwr_pa = memdup_user(rdwr_arg.msgs,
		rdwr_arg.nmsgs * sizeof(struct i2c_msg));
		rdwr_pa = memdup_array_user(rdwr_arg.msgs,
		rdwr_arg.nmsgs, sizeof(struct i2c_msg));
		if (IS_ERR(rdwr_pa))
		return PTR_ERR(rdwr_pa);