]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr()
authorAlexander Popov <alex.popov@linux.com>
Thu, 19 Apr 2018 12:29:22 +0000 (15:29 +0300)
committerWolfram Sang <wsa@the-dreams.de>
Fri, 27 Apr 2018 12:04:10 +0000 (14:04 +0200)
commit23a27722b5292ef0b27403c87a109feea8296a5c
tree3516ceaf2c36581588bcb11db81b669f4e45bba3
parent40d802cb66ad110673e40cb3426b1f1c79645104
i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr()

i2cdev_ioctl_rdwr() allocates i2c_msg.buf using memdup_user(), which
returns ZERO_SIZE_PTR if i2c_msg.len is zero.

Currently i2cdev_ioctl_rdwr() always dereferences the buf pointer in case
of I2C_M_RD | I2C_M_RECV_LEN transfer. That causes a kernel oops in
case of zero len.

Let's check the len against zero before dereferencing buf pointer.

This issue was triggered by syzkaller.

Signed-off-by: Alexander Popov <alex.popov@linux.com>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[wsa: use '< 1' instead of '!' for easier readability]
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
drivers/i2c/i2c-dev.c