i2c: dev: copy userspace array safely

[ Upstream commit cc9c54232f04aef3a5d7f64a0ece7df00f1aaa3d ]

i2c-dev.c utilizes memdup_user() to copy a userspace array. This is done
without an overflow check.

Use the new wrapper memdup_array_user() to copy the array more safely.

Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index a01b59e..7d33738 100644 (file)
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -450,8 +450,8 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
                        return -EINVAL;
 
-               rdwr_pa = memdup_user(rdwr_arg.msgs,
-                                     rdwr_arg.nmsgs * sizeof(struct i2c_msg));
+               rdwr_pa = memdup_array_user(rdwr_arg.msgs,
+                                           rdwr_arg.nmsgs, sizeof(struct i2c_msg));
                if (IS_ERR(rdwr_pa))
                        return PTR_ERR(rdwr_pa);