HomeFreeBSD

iic_rdwr_data->nmsgs is uint32_t, so limit the allowable number of messages…

Description

iic_rdwr_data->nmsgs is uint32_t, so limit the allowable number of messages to prevent memory exhaustion and short allocations on 32-bit systems. Since iicrdwr is intended to be a workalike of a Linux i2c-dev call, use the same limit of 42 that Linux uses.

Also check the return value of copyin(9) to prevent unnecessary allocation in the failure case.

Submitted by: ngie
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D5155

Details

Provenance
jahAuthored on
Reviewer
kib
Differential Revision
D5155: Add some missing integrity checks in iicrdwr()
Parents
rS300257: Fixup the geliboot sector rounding code
Branches
Unknown
Tags
Unknown