diff options
| author | Yingjoe Chen <yingjoe.chen@mediatek.com> | 2019-05-07 22:20:32 +0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-10-05 16:19:47 +0100 |
| commit | 38d23b28cdb3397d4271cb09f85acd66ff4d6af4 (patch) | |
| tree | cec9b97ebcee1b0e614ffc57a36fe7cab137fe05 /drivers/i2c | |
| parent | a7b95c54ef376c67e5fa89988df7d641107fc865 (diff) | |
| download | linux-stable-38d23b28cdb3397d4271cb09f85acd66ff4d6af4.tar.gz linux-stable-38d23b28cdb3397d4271cb09f85acd66ff4d6af4.tar.bz2 linux-stable-38d23b28cdb3397d4271cb09f85acd66ff4d6af4.zip | |
i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
commit a0692f0eef91354b62c2b4c94954536536be5425 upstream.
If I2C_M_RECV_LEN check failed, msgs[i].buf allocated by memdup_user
will not be freed. Pump index up so it will be freed.
Fixes: 838bfa6049fb ("i2c-dev: Add support for I2C_M_RECV_LEN")
Signed-off-by: Yingjoe Chen <yingjoe.chen@mediatek.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/i2c')
| -rw-r--r-- | drivers/i2c/i2c-dev.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c index 69640fa51cb8..0c2e3edf290f 100644 --- a/drivers/i2c/i2c-dev.c +++ b/drivers/i2c/i2c-dev.c @@ -300,6 +300,7 @@ static noinline int i2cdev_ioctl_rdrw(struct i2c_client *client, rdwr_pa[i].buf[0] < 1 || rdwr_pa[i].len < rdwr_pa[i].buf[0] + I2C_SMBUS_BLOCK_MAX) { + i++; res = -EINVAL; break; } |