Hello,
When doing i2c block read the lenght is passed as the first byte of the buffer,
so we must copy it from user otherwise temp is uninitialized.
Signed-off-by: Alexander Atanasov <[email protected]>
--
have fun,
alex
--- drivers/i2c/i2c-dev.c.orig 2006-01-04 02:00:00.000000000 +0200
+++ drivers/i2c/i2c-dev.c 2006-06-07 19:46:08.000000000 +0300
@@ -337,6 +337,7 @@
if ((data_arg.size == I2C_SMBUS_PROC_CALL) ||
(data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||
+ (data_arg.size == I2C_SMBUS_BLOCK_DATA) ||
(data_arg.read_write == I2C_SMBUS_WRITE)) {
if (copy_from_user(&temp, data_arg.data, datasize))
return -EFAULT;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
