scx200_acb: Fix the block

PATCH New Greg KH 1 participant 1 message Jul 12, 2006

Subsystems (2)

I2C subsystem host drivers SCx200 CPU support

lore

Share & tools

lore

Greg KH

author

2006-07-12 23:27 UTC #0 lore raw

PATCH 4/13 scx200_acb: Fix the block

From: Jean Delvare <khali at linux-fr.org>

The scx200_acb i2c bus driver pretends to support SMBus block transactions, but in fact it implements the more simple I2C block transactions. Additionally, it lacks sanity checks on the length of the block transactions, which could lead to a buffer overrun.

This fixes an oops reported by Alexander Atanasov:
http://marc.theaimsgroup.com/?l=linux-kernel&m4970382125094

Thanks to Ben Gardner for fixing my bugs :)

Signed-off-by Jean Delvare <khali at linux-fr.org>

Signed-off-by Greg Kroah-Hartman <gregkh at suse.de>

---
 drivers/i2c/busses/scx200_acb.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

drivers/i2c/busses/scx200_acb.c +6 -2

index 454086a..ced309f 100644
@@ -307,8 +307,12 @@ static s32 scx200_acb_smbus_xfer(struct 
 		buffer = (u8 *)&cur_word;
 		break;
 
-	case I2C_SMBUS_BLOCK_DATA:
+	case I2C_SMBUS_I2C_BLOCK_DATA:
+		if (rw = I2C_SMBUS_READ)
+			data->block[0] = I2C_SMBUS_BLOCK_MAX; /* For now */
 		len = data->block[0];
+		if (len = 0 || len > I2C_SMBUS_BLOCK_MAX)
+			return -EINVAL;
 		buffer = &data->block[1];
 		break;

@@ -372,7 +376,7 @@ static u32 scx200_acb_func(struct i2c_ad
 {
 	return I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
 	       I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
-	       I2C_FUNC_SMBUS_BLOCK_DATA;
+	       I2C_FUNC_SMBUS_I2C_BLOCK;
 }
 
 /* For now, we only handle combined mode (smbus) */

Signature · 1 line

1.4.1