Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9bdbaeba authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 

Pull i2c fixes from Wolfram Sang:
 "Two bugfixes for the I2C core: Lixing Wang fixed a refcounting problem
  with DT nodes. Jeremy Compostella fixed a buffer overflow possibility
  when using a 'don't use' ioctl interface directly"

* 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
  i2c: core: decrease reference count of device node in i2c_unregister_device
parents 9f77a11a 89c6efa6

drivers/i2c/i2c-core-base.c

+5 −1
Original line number Diff line number Diff line
@@ -821,8 +821,12 @@ void i2c_unregister_device(struct i2c_client *client) 
{

	if (!client)

		return;

	if (client->dev.of_node)



	if (client->dev.of_node) {

		of_node_clear_flag(client->dev.of_node, OF_POPULATED);

		of_node_put(client->dev.of_node);

	}



	if (ACPI_COMPANION(&client->dev))

		acpi_device_clear_enumerated(ACPI_COMPANION(&client->dev));

	device_unregister(&client->dev);

drivers/i2c/i2c-core-smbus.c

+7 −6
Original line number Diff line number Diff line
@@ -397,16 +397,17 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr, 
				   the underlying bus driver */

		break;

	case I2C_SMBUS_I2C_BLOCK_DATA:

		if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {

			dev_err(&adapter->dev, "Invalid block %s size %d\n",

				read_write == I2C_SMBUS_READ ? "read" : "write",

				data->block[0]);

			return -EINVAL;

		}



		if (read_write == I2C_SMBUS_READ) {

			msg[1].len = data->block[0];

		} else {

			msg[0].len = data->block[0] + 1;

			if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {

				dev_err(&adapter->dev,

					"Invalid block write size %d\n",

					data->block[0]);

				return -EINVAL;

			}

			for (i = 1; i <= data->block[0]; i++)

				msgbuf0[i] = data->block[i];

		}