diff options
| author | Alexander Popov <[email protected]> | 2018-04-19 12:29:22 +0000 |
|---|---|---|
| committer | Wolfram Sang <[email protected]> | 2018-04-27 12:04:10 +0000 |
| commit | 23a27722b5292ef0b27403c87a109feea8296a5c (patch) | |
| tree | 3516ceaf2c36581588bcb11db81b669f4e45bba3 /fs/proc/array.c | |
| parent | Documentation/i2c: adopt kernel commenting style in examples (diff) | |
| download | kernel-23a27722b5292ef0b27403c87a109feea8296a5c.tar.gz kernel-23a27722b5292ef0b27403c87a109feea8296a5c.zip | |
i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr()
i2cdev_ioctl_rdwr() allocates i2c_msg.buf using memdup_user(), which
returns ZERO_SIZE_PTR if i2c_msg.len is zero.
Currently i2cdev_ioctl_rdwr() always dereferences the buf pointer in case
of I2C_M_RD | I2C_M_RECV_LEN transfer. That causes a kernel oops in
case of zero len.
Let's check the len against zero before dereferencing buf pointer.
This issue was triggered by syzkaller.
Signed-off-by: Alexander Popov <[email protected]>
Reviewed-by: Uwe Kleine-König <[email protected]>
[wsa: use '< 1' instead of '!' for easier readability]
Signed-off-by: Wolfram Sang <[email protected]>
Diffstat (limited to 'fs/proc/array.c')
0 files changed, 0 insertions, 0 deletions