D5155.id16564.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D5155.id16564.diff
View Options

	Index: sys/dev/iicbus/iic.h
	===================================================================
	--- sys/dev/iicbus/iic.h
	+++ sys/dev/iicbus/iic.h
	@@ -56,6 +56,8 @@
	uint32_t nmsgs;
	};

	+#define IIC_RDRW_MAX_MSGS 42
	+
	#define I2CSTART _IOW('i', 1, struct iiccmd) /* start condition */
	#define I2CSTOP _IO('i', 2) /* stop condition */
	#define I2CRSTCARD _IOW('i', 3, struct iiccmd) /* reset the card */
	Index: sys/dev/iicbus/iic.c
	===================================================================
	--- sys/dev/iicbus/iic.c
	+++ sys/dev/iicbus/iic.c
	@@ -300,9 +300,16 @@
	parent = device_get_parent(iicdev);
	error = 0;

	+ if (d->nmsgs > IIC_RDRW_MAX_MSGS)
	+ return (EINVAL);
	+
	buf = malloc(sizeof(d->msgs) d->nmsgs, M_IIC, M_WAITOK);

	error = copyin(d->msgs, buf, sizeof(d->msgs) d->nmsgs);
	+ if (error != 0) {
	+ free(buf, M_IIC);
	+ return (error);
	+ }

	/* Alloc kernel buffers for userland data, copyin write data */
	usrbufs = malloc(sizeof(void ) d->nmsgs, M_IIC, M_WAITOK \| M_ZERO);
	@@ -318,6 +325,8 @@
	m->buf = NULL;
	if (error != 0)
	continue;
	+
	+ /* m->len is uint16_t, so allocation size is capped at 64K. */
	m->buf = malloc(m->len, M_IIC, M_WAITOK);
	if (!(m->flags & IIC_M_RD))
	error = copyin(usrbufs[i], m->buf, m->len);