i2c: dev: copy userspace array safely
authorPhilipp Stanner <pstanner@redhat.com>
Thu, 2 Nov 2023 19:26:13 +0000 (20:26 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 28 Nov 2023 17:19:47 +0000 (17:19 +0000)
[ Upstream commit cc9c54232f04aef3a5d7f64a0ece7df00f1aaa3d ]

i2c-dev.c utilizes memdup_user() to copy a userspace array. This is done
without an overflow check.

Use the new wrapper memdup_array_user() to copy the array more safely.

Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/i2c/i2c-dev.c

index a01b59e..7d33738 100644 (file)
@@ -450,8 +450,8 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
                        return -EINVAL;
 
-               rdwr_pa = memdup_user(rdwr_arg.msgs,
-                                     rdwr_arg.nmsgs * sizeof(struct i2c_msg));
+               rdwr_pa = memdup_array_user(rdwr_arg.msgs,
+                                           rdwr_arg.nmsgs, sizeof(struct i2c_msg));
                if (IS_ERR(rdwr_pa))
                        return PTR_ERR(rdwr_pa);