Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-01-18 07:53:27 +0100
committerJiri Slaby <jslaby@suse.cz>2019-01-18 07:53:37 +0100
commit1c56656e1e847db2fa84959e8a5ebc1790a164a4 (patch)
treee905957d273ce1f7139d7016cae088735289cb3b
parent2e83537aaf61449afcef4ecf7cd4431b9dee8e17 (diff)
i2c: dev: prevent adapter retries and timeout being set as
minus value (bnc#1012628).
-rw-r--r--patches.kernel.org/4.20.3-034-i2c-dev-prevent-adapter-retries-and-timeout-be.patch56
-rw-r--r--series.conf1
2 files changed, 57 insertions, 0 deletions
diff --git a/patches.kernel.org/4.20.3-034-i2c-dev-prevent-adapter-retries-and-timeout-be.patch b/patches.kernel.org/4.20.3-034-i2c-dev-prevent-adapter-retries-and-timeout-be.patch
new file mode 100644
index 0000000000..ecca73f9c0
--- /dev/null
+++ b/patches.kernel.org/4.20.3-034-i2c-dev-prevent-adapter-retries-and-timeout-be.patch
@@ -0,0 +1,56 @@
+From: Yi Zeng <yizeng@asrmicro.com>
+Date: Wed, 9 Jan 2019 15:33:07 +0800
+Subject: [PATCH] i2c: dev: prevent adapter retries and timeout being set as
+ minus value
+References: bnc#1012628
+Patch-mainline: 4.20.3
+Git-commit: 6ebec961d59bccf65d08b13fc1ad4e6272a89338
+
+commit 6ebec961d59bccf65d08b13fc1ad4e6272a89338 upstream.
+
+If adapter->retries is set to a minus value from user space via ioctl,
+it will make __i2c_transfer and __i2c_smbus_xfer skip the calling to
+adapter->algo->master_xfer and adapter->algo->smbus_xfer that is
+registered by the underlying bus drivers, and return value 0 to all the
+callers. The bus driver will never be accessed anymore by all users,
+besides, the users may still get successful return value without any
+error or information log print out.
+
+If adapter->timeout is set to minus value from user space via ioctl,
+it will make the retrying loop in __i2c_transfer and __i2c_smbus_xfer
+always break after the the first try, due to the time_after always
+returns true.
+
+Signed-off-by: Yi Zeng <yizeng@asrmicro.com>
+[wsa: minor grammar updates to commit message]
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/i2c/i2c-dev.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index 1aca742fde4a..ccd76c71af09 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -470,9 +470,15 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ data_arg.data);
+ }
+ case I2C_RETRIES:
++ if (arg > INT_MAX)
++ return -EINVAL;
++
+ client->adapter->retries = arg;
+ break;
+ case I2C_TIMEOUT:
++ if (arg > INT_MAX)
++ return -EINVAL;
++
+ /* For historical reasons, user-space sets the timeout
+ * value in units of 10 ms.
+ */
+--
+2.20.1
+
diff --git a/series.conf b/series.conf
index a541c5a723..cfa1e69ee5 100644
--- a/series.conf
+++ b/series.conf
@@ -271,6 +271,7 @@
patches.kernel.org/4.20.3-031-ACPI-power-Skip-duplicate-power-resource-refer.patch
patches.kernel.org/4.20.3-032-ACPI-PMIC-xpower-Fix-TS-pin-current-source-han.patch
patches.kernel.org/4.20.3-033-ACPI-IORT-Fix-rc_dma_get_range.patch
+ patches.kernel.org/4.20.3-034-i2c-dev-prevent-adapter-retries-and-timeout-be.patch
########################################################
# Build fixes that apply to the vanilla kernel too.