diff options
Diffstat (limited to 'sys-kernel/compaq-sources/files/compaq-sources-2.4.9.32.7.I2C_Limits.patch')
| -rw-r--r-- | sys-kernel/compaq-sources/files/compaq-sources-2.4.9.32.7.I2C_Limits.patch | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/sys-kernel/compaq-sources/files/compaq-sources-2.4.9.32.7.I2C_Limits.patch b/sys-kernel/compaq-sources/files/compaq-sources-2.4.9.32.7.I2C_Limits.patch new file mode 100644 index 000000000000..af20a6fc0c2c --- /dev/null +++ b/sys-kernel/compaq-sources/files/compaq-sources-2.4.9.32.7.I2C_Limits.patch @@ -0,0 +1,44 @@ +--- linux-2.4.20/drivers/i2c/i2c-dev.c 2004-06-19 03:27:30 -07:00 ++++ linux-2.4.21/drivers/i2c/i2c-dev.c 2004-06-19 03:27:30 -07:00 +@@ -254,6 +254,11 @@ + sizeof(rdwr_arg))) + return -EFAULT; + ++ /* Put an arbritrary limit on the number of messages that can ++ * be sent at once */ ++ if (rdwr_arg.nmsgs > 42) ++ return -EINVAL; ++ + rdwr_pa = (struct i2c_msg *) + kmalloc(rdwr_arg.nmsgs * sizeof(struct i2c_msg), + GFP_KERNEL); +@@ -270,6 +275,11 @@ + res = -EFAULT; + break; + } ++ /* Limit the size of the message to a sane amount */ ++ if (rdwr_pa[i].len > 8192) { ++ res = -EINVAL; ++ break; ++ } + rdwr_pa[i].buf = kmalloc(rdwr_pa[i].len, GFP_KERNEL); + if(rdwr_pa[i].buf == NULL) + { +@@ -280,10 +290,16 @@ + rdwr_arg.msgs[i].buf, + rdwr_pa[i].len)) + { +- kfree(rdwr_pa[i].buf); + res = -EFAULT; + break; + } ++ } ++ if (res < 0) { ++ int j; ++ for (j = 0; j < i; ++j) ++ kfree(rdwr_pa[j].buf); ++ kfree(rdwr_pa); ++ return res; + } + if (!res) + { |