Re: [PATCH 08/26] dib0700_core: don't use stack on I2C reads

[Patrick Boettcher <patrick.boettcher@posteo.de>]

On Fri,  7 Oct 2016 14:24:18 -0300
Mauro Carvalho Chehab <mchehab@s-opensource.com> wrote:

> Be sure that I2C reads won't use stack by passing
> a pointer to the state buffer, that we know it was
> allocated via kmalloc, instead of relying on the buffer
> allocated by an I2C client.
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> ---
>  drivers/media/usb/dvb-usb/dib0700_core.c | 27
> ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1
> deletion(-)
> 
> diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c
> b/drivers/media/usb/dvb-usb/dib0700_core.c index
> 515f89dba199..92d5408684ac 100644 ---
> a/drivers/media/usb/dvb-usb/dib0700_core.c +++
> b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -213,7 +213,7 @@ static
> int dib0700_i2c_xfer_new(struct i2c_adapter *adap, struct i2c_msg
> *msg, usb_rcvctrlpipe(d->udev, 0), REQUEST_NEW_I2C_READ,
>  						 USB_TYPE_VENDOR |
> USB_DIR_IN,
> -						 value, index,
> msg[i].buf,
> +						 value, index,
> st->buf, msg[i].len,
>  						 USB_CTRL_GET_TIMEOUT);
>  			if (result < 0) {
> @@ -221,6 +221,14 @@ static int dib0700_i2c_xfer_new(struct
> i2c_adapter *adap, struct i2c_msg *msg, break;
>  			}
>  
> +			if (msg[i].len > sizeof(st->buf)) {
> +				deb_info("buffer too small to fit %d
> bytes\n",
> +					 msg[i].len);
> +				return -EIO;
> +			}
> +
> +			memcpy(msg[i].buf, st->buf, msg[i].len);
> +
>  			deb_data("<<< ");
>  			debug_dump(msg[i].buf, msg[i].len, deb_data);
>  
> @@ -238,6 +246,13 @@ static int dib0700_i2c_xfer_new(struct
> i2c_adapter *adap, struct i2c_msg *msg, /* I2C ctrl + FE bus; */
>  			st->buf[3] = ((gen_mode << 6) & 0xC0) |
>  				 ((bus_mode << 4) & 0x30);
> +
> +			if (msg[i].len > sizeof(st->buf) - 4) {
> +				deb_info("i2c message to big: %d\n",
> +					 msg[i].len);
> +				return -EIO;
> +			}
> +
>  			/* The Actual i2c payload */
>  			memcpy(&st->buf[4], msg[i].buf, msg[i].len);
>  
> @@ -283,6 +298,11 @@ static int dib0700_i2c_xfer_legacy(struct
> i2c_adapter *adap, /* fill in the address */
>  		st->buf[1] = msg[i].addr << 1;
>  		/* fill the buffer */
> +		if (msg[i].len > sizeof(st->buf) - 2) {
> +			deb_info("i2c xfer to big: %d\n",
> +				msg[i].len);
> +			return -EIO;
> +		}
>  		memcpy(&st->buf[2], msg[i].buf, msg[i].len);
>  
>  		/* write/read request */
> @@ -299,6 +319,11 @@ static int dib0700_i2c_xfer_legacy(struct
> i2c_adapter *adap, break;
>  			}
>  
> +			if (msg[i + 1].len > sizeof(st->buf)) {
> +				deb_info("i2c xfer buffer to small
> for %d\n",
> +					msg[i].len);
> +				return -EIO;
> +			}
>  			memcpy(msg[i + 1].buf, st->buf, msg[i +
> 1].len); 
>  			msg[i+1].len = len;

Reviewed-By: Patrick Boettcher <patrick.boettcher@posteo.de>