Messages in this thread Patch in this message | | | Date | Tue, 15 Jun 2004 16:39:20 +0100 (BST) | From | Shaun Colley <> | Subject | Re: i2c device driver bugs |
| |
Hi Greg,
> Please let us know exactly what kernel version you > see this in. It > looks to me that it is fixed in the latest 2.4 and > 2.6 versions. If you > do not think so, please let us know.
I was actually looking at a fairly old version of the source tree (2.4.19, 2.4.20) -- it appears that a quick fix fixed this vulnerability in 2.4.21:
http://lxr.linux.no/diff/drivers/i2c/i2c-dev.c?diffval=2.4.21;diffvar=v
If you scroll down a bit, you should see:
--- if (rdwr_arg.nmsgs > 42) return -EINVAL; ---
It looks like a quick sanity check was added in the 'I2C_RDWR' option, to fix the issue.
I'm downloading the 2.4.21 patch to check if the fixing of this was recorded, or whether it was silently fixed (looks like it was).
Confirmed. 2.4.21 fixed the bug:
--- [shaun@cpc2-mars1-3-0-cust191 shaun]$ grep -n -A 10 "sent at once" * patch-2.4.21:162276:+ * be sent at once */ patch-2.4.21-162277-+ if (rdwr_arg.nmsgs > 42) patch-2.4.21-162278-+ return -EINVAL; patch-2.4.21-162279-+ patch-2.4.21-162280- rdwr_pa = (struct i2c_msg *) patch-2.4.21-162281- kmalloc(rdwr_arg.nmsgs * sizeof(struct i2c_msg), patch-2.4.21-162282- GFP_KERNEL); patch-2.4.21-162283-@@ -270,6 +275,11 @@ patch-2.4.21-162284- res = -EFAULT; patch-2.4.21-162285- break; patch-2.4.21-162286- } [shaun@cpc2-mars1-3-0-cust191 shaun]$ ---
It's also fixed in all versions of 2.6...
However, the vulnerbility seems to still be present in 2.5 -- latest version.
So, to sum it up:
- Not present in 2.2, because the driver wasn't implemented as fully as it is now. - Present in 2.4 versions 2.4.20 and below. - Present in 2.5 - Not present in 2.6
As for the second bug, it's fixed in 2.4.9, 2.5, and 2.6.
Thank you for your time. Shaun.
___________________________________________________________ALL-NEW Yahoo! Messenger - sooooo many all-new ways to express yourself http://uk.messenger.yahoo.com - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |