svn commit: r300258 - head/sys/dev/iicbus

Jason A. Harmening jah at FreeBSD.org
Fri May 20 03:03:05 UTC 2016


Author: jah
Date: Fri May 20 03:03:04 2016
New Revision: 300258
URL: https://svnweb.freebsd.org/changeset/base/300258

Log:
  iic_rdwr_data->nmsgs is uint32_t, so limit the allowable number of messages to prevent memory exhaustion and short allocations on 32-bit systems. Since iicrdwr is intended to be a workalike of a Linux i2c-dev call, use the same limit of 42 that Linux uses.
  
  Also check the return value of copyin(9) to prevent unnecessary allocation in the failure case.
  
  Submitted by:	ngie
  Reviewed by:	kib
  MFC after:	1 week
  Differential Revision:	https://reviews.freebsd.org/D5155

Modified:
  head/sys/dev/iicbus/iic.c
  head/sys/dev/iicbus/iic.h

Modified: head/sys/dev/iicbus/iic.c
==============================================================================
--- head/sys/dev/iicbus/iic.c	Fri May 20 01:41:47 2016	(r300257)
+++ head/sys/dev/iicbus/iic.c	Fri May 20 03:03:04 2016	(r300258)
@@ -300,9 +300,16 @@ iicrdwr(struct iic_cdevpriv *priv, struc
 	parent = device_get_parent(iicdev);
 	error = 0;
 
+	if (d->nmsgs > IIC_RDRW_MAX_MSGS)
+		return (EINVAL);
+
 	buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_IIC, M_WAITOK);
 
 	error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs);
+	if (error != 0) {
+		free(buf, M_IIC);
+		return (error);
+	}
 
 	/* Alloc kernel buffers for userland data, copyin write data */
 	usrbufs = malloc(sizeof(void *) * d->nmsgs, M_IIC, M_WAITOK | M_ZERO);
@@ -318,6 +325,8 @@ iicrdwr(struct iic_cdevpriv *priv, struc
 		m->buf = NULL;
 		if (error != 0)
 			continue;
+
+		/* m->len is uint16_t, so allocation size is capped at 64K. */
 		m->buf = malloc(m->len, M_IIC, M_WAITOK);
 		if (!(m->flags & IIC_M_RD))
 			error = copyin(usrbufs[i], m->buf, m->len);

Modified: head/sys/dev/iicbus/iic.h
==============================================================================
--- head/sys/dev/iicbus/iic.h	Fri May 20 01:41:47 2016	(r300257)
+++ head/sys/dev/iicbus/iic.h	Fri May 20 03:03:04 2016	(r300258)
@@ -56,6 +56,8 @@ struct iic_rdwr_data {
 	uint32_t nmsgs;
 };
 
+#define IIC_RDRW_MAX_MSGS	42
+
 #define I2CSTART	_IOW('i', 1, struct iiccmd)	/* start condition */
 #define I2CSTOP		_IO('i', 2)			/* stop condition */
 #define I2CRSTCARD	_IOW('i', 3, struct iiccmd)	/* reset the card */


More information about the svn-src-head mailing list