From patchwork Tue May 7 14:20:32 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yingjoe Chen X-Patchwork-Id: 10933053 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D87101398 for ; Tue, 7 May 2019 14:21:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C1AE028BF0 for ; Tue, 7 May 2019 14:21:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BF60A28BC9; Tue, 7 May 2019 14:21:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 69EDB28BC9 for ; Tue, 7 May 2019 14:21:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=iB7mkwJm8uMKAuSKHsxCBJ26d6D9omlwV2EkEoWCdZU=; b=JraowMDuAj0AzH 5MwKZ491ErkJecVxdaH17lcRjsVE9fz29nbzOPvviBKfcwRC8V03Bq0sb+g2qQHWGvmPlCpL/ekOl dtvhAqzvVDC0Vy26+GTuz5c2RI5XzTmStNbCQOew2Zv6w9kANPwNgFfXzaWdQhhf1uIZ7Dz2gFnWO Q+HG0BAIgZZFfw5UiCNkcHzyYrwkQoUf4HDEVYgKj1F5O6SwOL3r8yTEuPklLa2VB4j/tjB8yVnCt 82G2oAsDUmzy2LPSFn7KdmOVi33y/t9YSBvTpC7DK8ODZvy27kl8yUKCi46+OwZ8bzr+8mUVZIC8t ZkKawLDANgZVuu0aHHZw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hO0xx-0006bh-FF; Tue, 07 May 2019 14:21:09 +0000 Received: from mailgw02.mediatek.com ([216.200.240.185]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1hO0xu-0006bH-Hl; Tue, 07 May 2019 14:21:07 +0000 X-UUID: 7f8d925846c6456394a1e3639b48bf0f-20190507 X-UUID: 7f8d925846c6456394a1e3639b48bf0f-20190507 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw02.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLS) with ESMTP id 2062797564; Tue, 07 May 2019 06:21:01 -0800 Received: from mtkmbs03n2.mediatek.inc (172.21.101.182) by MTKMBS62N2.mediatek.inc (172.29.193.42) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 7 May 2019 07:21:00 -0700 Received: from mtkcas07.mediatek.inc (172.21.101.84) by mtkmbs03n2.mediatek.inc (172.21.101.182) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 7 May 2019 22:20:57 +0800 Received: from mtksdaap41.mediatek.inc (172.21.77.4) by mtkcas07.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1395.4 via Frontend Transport; Tue, 7 May 2019 22:20:57 +0800 From: Yingjoe Chen To: Wolfram Sang , Jean Delvare Subject: [PATCH] i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr Date: Tue, 7 May 2019 22:20:32 +0800 Message-ID: <1557238832-10723-1-git-send-email-yingjoe.chen@mediatek.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-TM-SNTS-SMTP: 82EDD77E36B98B06E0D48449A43857A9C339EBD6B0843B3FFEA6EE130FBF90972000:8 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190507_072106_591196_623CDF05 X-CRM114-Status: UNSURE ( 9.54 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: srv_heupstream@mediatek.com, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, linux-i2c@vger.kernel.org, Yingjoe Chen , linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP If I2C_M_RECV_LEN check failed, msgs[i].buf allocated by memdup_user will not be freed. Pump index up so it will be freed. Fixes: 838bfa6049fb ("i2c-dev: Add support for I2C_M_RECV_LEN") Signed-off-by: Yingjoe Chen --- Only check arm64 defconfig build pass. I haven't test it since it just fix memleak for error cases. --- drivers/i2c/i2c-dev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c index 3f7b9af..776f366 100644 --- a/drivers/i2c/i2c-dev.c +++ b/drivers/i2c/i2c-dev.c @@ -283,6 +283,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client, msgs[i].len < 1 || msgs[i].buf[0] < 1 || msgs[i].len < msgs[i].buf[0] + I2C_SMBUS_BLOCK_MAX) { + i++; res = -EINVAL; break; }