From patchwork Fri Mar 12 11:57:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wolfram Sang X-Patchwork-Id: 399094 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1FC5C433DB for ; Fri, 12 Mar 2021 11:58:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AA5C464FE0 for ; Fri, 12 Mar 2021 11:58:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230072AbhCLL6A (ORCPT ); Fri, 12 Mar 2021 06:58:00 -0500 Received: from www.zeus03.de ([194.117.254.33]:39470 "EHLO mail.zeus03.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229866AbhCLL5p (ORCPT ); Fri, 12 Mar 2021 06:57:45 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=sang-engineering.com; h= from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; s=k1; bh=iaBckEgUieoJW6UiJu5aejon2xH cuC8ygE1XFQ9BWwc=; b=Ep60/7FHkx0JonwGX9Y+Jt/09ThhkCUmxsUlPj6nEZN S5KlhEbUYQyYNv6qZtF4KCwoby1O7LXY/p2o/7eKsouMCNNN5bd8p0MY+ggiXt+t eZhXYYZdrV5ZPr4zwG9enIT8wIzAjysXUUqScVhL5/vEr3MHJGhtSP3WTRbrDSMA = Received: (qmail 366347 invoked from network); 12 Mar 2021 12:57:43 +0100 Received: by mail.zeus03.de with ESMTPSA (TLS_AES_256_GCM_SHA384 encrypted, authenticated); 12 Mar 2021 12:57:43 +0100 X-UD-Smtp-Session: l3s3148p1@BSiSm1W9oOYgAwDPXwjxAOzndPPvnXZD From: Wolfram Sang To: linux-i2c@vger.kernel.org Cc: Wolfram Sang , syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com Subject: [PATCH] i2c: bail out early when RDWR parameters are wrong Date: Fri, 12 Mar 2021 12:57:34 +0100 Message-Id: <20210312115734.14022-1-wsa+renesas@sang-engineering.com> X-Mailer: git-send-email 2.30.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-i2c@vger.kernel.org The buggy parameters currently get caught later, but emit a noisy WARN. Userspace should not be able to trigger this, so add similar checks much earlier. Also avoids some unneeded code paths, of course. Apply kernel coding stlye to a comment while here. Reported-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com Tested-by: syzbot+ffb0b3ffa6cfbc7d7b3f@syzkaller.appspotmail.com Signed-off-by: Wolfram Sang --- drivers/i2c/i2c-dev.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c index 6ceb11cc4be1..6ef38a8ee95c 100644 --- a/drivers/i2c/i2c-dev.c +++ b/drivers/i2c/i2c-dev.c @@ -440,8 +440,13 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) sizeof(rdwr_arg))) return -EFAULT; - /* Put an arbitrary limit on the number of messages that can - * be sent at once */ + if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0) + return -EINVAL; + + /* + * Put an arbitrary limit on the number of messages that can + * be sent at once + */ if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS) return -EINVAL;