lkml.org 
[lkml]   [2004]   [Jun]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: i2c device driver bugs
Hi Greg,

> Please let us know exactly what kernel version you
> see this in. It
> looks to me that it is fixed in the latest 2.4 and
> 2.6 versions. If you
> do not think so, please let us know.

I was actually looking at a fairly old version of the
source tree (2.4.19, 2.4.20) -- it appears that a
quick fix fixed this vulnerability in 2.4.21:

http://lxr.linux.no/diff/drivers/i2c/i2c-dev.c?diffval=2.4.21;diffvar=v

If you scroll down a bit, you should see:

---
if (rdwr_arg.nmsgs > 42)
return -EINVAL;
---

It looks like a quick sanity check was added in the
'I2C_RDWR' option, to fix the issue.

I'm downloading the 2.4.21 patch to check if the
fixing of this was recorded, or whether it was
silently fixed (looks like it was).

Confirmed. 2.4.21 fixed the bug:

---
[shaun@cpc2-mars1-3-0-cust191 shaun]$ grep -n -A 10
"sent at once" *
patch-2.4.21:162276:+ * be sent at once */
patch-2.4.21-162277-+ if (rdwr_arg.nmsgs > 42)
patch-2.4.21-162278-+ return -EINVAL;
patch-2.4.21-162279-+
patch-2.4.21-162280- rdwr_pa = (struct i2c_msg *)
patch-2.4.21-162281- kmalloc(rdwr_arg.nmsgs *
sizeof(struct i2c_msg),
patch-2.4.21-162282- GFP_KERNEL);
patch-2.4.21-162283-@@ -270,6 +275,11 @@
patch-2.4.21-162284- res = -EFAULT;
patch-2.4.21-162285- break;
patch-2.4.21-162286- }
[shaun@cpc2-mars1-3-0-cust191 shaun]$
---


It's also fixed in all versions of 2.6...

However, the vulnerbility seems to still be present in
2.5 -- latest version.

So, to sum it up:

- Not present in 2.2, because the driver wasn't
implemented as fully as it is now.
- Present in 2.4 versions 2.4.20 and below.
- Present in 2.5
- Not present in 2.6


As for the second bug, it's fixed in 2.4.9, 2.5, and
2.6.



Thank you for your time.
Shaun.






___________________________________________________________ALL-NEW Yahoo! Messenger - sooooo many all-new ways to express yourself http://uk.messenger.yahoo.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-03-22 14:03    [W:0.572 / U:0.360 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site