d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iic_rdwr_data->nmsgs is uint32_t, so limit the allowable number of messages to prevent memory exhaustion and short allocations on 32-bit systems. Since iicrdwr is intended to be a workalike of a Linux i2c-dev call, use the same limit of 42 that Linux uses.

Browse Source 
Also check the return value of copyin(9) to prevent unnecessary allocation in the failure case.

Submitted by:	ngie
Reviewed by:	kib
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D5155
This commit is contained in:
jah 2016-05-20 03:03:04 +00:00
parent b245978b18
commit 09fce610f9
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/dev/iicbus/iic.c
View File

@ -300,9 +300,16 @@ iicrdwr(struct iic_cdevpriv *priv, struct iic_rdwr_data *d, int flags)
parent = device_get_parent(iicdev);
error = 0;
if (d->nmsgs > IIC_RDRW_MAX_MSGS)
return (EINVAL);
buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_IIC, M_WAITOK);
error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs);
if (error != 0) {
free(buf, M_IIC);
return (error);
}
/* Alloc kernel buffers for userland data, copyin write data */
usrbufs = malloc(sizeof(void *) * d->nmsgs, M_IIC, M_WAITOK | M_ZERO);
@ -318,6 +325,8 @@ iicrdwr(struct iic_cdevpriv *priv, struct iic_rdwr_data *d, int flags)
m->buf = NULL;
if (error != 0)
continue;
/* m->len is uint16_t, so allocation size is capped at 64K. */
m->buf = malloc(m->len, M_IIC, M_WAITOK);
if (!(m->flags & IIC_M_RD))
error = copyin(usrbufs[i], m->buf, m->len);

2
sys/dev/iicbus/iic.h
View File

@ -56,6 +56,8 @@ struct iic_rdwr_data {
uint32_t nmsgs;
};
#define IIC_RDRW_MAX_MSGS 42
#define I2CSTART _IOW('i', 1, struct iiccmd) /* start condition */
#define I2CSTOP _IO('i', 2) /* stop condition */
#define I2CRSTCARD _IOW('i', 3, struct iiccmd) /* reset the card */