From: Jean Delvare <khali@linux-fr.org>
To: Marcelo Tosatti <marcelo.tosatti@cyclades.com>,
LKML <linux-kernel@vger.kernel.org>
Subject: [PATCH 2.4] I2C updates for 2.4.28 (3/5)
Date: Sat, 20 Nov 2004 13:26:47 +0100 [thread overview]
Message-ID: <20041120132647.364b2fa4.khali@linux-fr.org> (raw)
In-Reply-To: <20041120125423.42527051.khali@linux-fr.org>
Original report and discussion:
http://marc.theaimsgroup.com/?l=linux-arm-kernel&m=109816546827995&w=2
http://marc.theaimsgroup.com/?l=linux-arm-kernel&m=109926079025024&w=2
Bottom line:
Two hardcoded buffer sizes in i2c_smbus_xfer_emulated (i2c-core) should
depend on I2C_SMBUS_BLOCK_MAX. Else increasing I2C_SMBUS_BLOCK_MAX (in
include/linux/i2c.h) will result in buffer overflows.
Credits go to Tehn Yit Chin for noticing the suspicious hardcoded
values.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
--- linux-2.4.28-rc1/drivers/i2c/i2c-core.c.orig 2004-10-27 23:45:48.000000000 +0200
+++ linux-2.4.28-rc1/drivers/i2c/i2c-core.c 2004-10-29 19:18:09.000000000 +0200
@@ -1098,8 +1098,8 @@
need to use only one message; when reading, we need two. We initialize
most things with sane defaults, to keep the code below somewhat
simpler. */
- unsigned char msgbuf0[34];
- unsigned char msgbuf1[34];
+ unsigned char msgbuf0[I2C_SMBUS_BLOCK_MAX+2];
+ unsigned char msgbuf1[I2C_SMBUS_BLOCK_MAX+2];
int num = read_write == I2C_SMBUS_READ?2:1;
struct i2c_msg msg[2] = { { addr, flags, 1, msgbuf0 },
{ addr, flags | I2C_M_RD, 0, msgbuf1 }
--
Jean Delvare
http://khali.linux-fr.org/
next prev parent reply other threads:[~2004-11-20 12:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-11-20 11:54 I2C updates for 2.4.28 Jean Delvare
2004-11-20 12:07 ` [PATCH 2.4] I2C updates for 2.4.28 (1/5) Jean Delvare
2004-11-20 12:16 ` [PATCH 2.4] I2C updates for 2.4.28 (2/5) Jean Delvare
2004-11-20 12:26 ` Jean Delvare [this message]
2004-11-20 12:42 ` [PATCH 2.4] I2C updates for 2.4.28 (5/5) Jean Delvare
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20041120132647.364b2fa4.khali@linux-fr.org \
--to=khali@linux-fr.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcelo.tosatti@cyclades.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox