| From: Yingjoe Chen <yingjoe.chen@mediatek.com> |
| Date: Tue, 7 May 2019 22:20:32 +0800 |
| Subject: i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr |
| |
| commit a0692f0eef91354b62c2b4c94954536536be5425 upstream. |
| |
| If I2C_M_RECV_LEN check failed, msgs[i].buf allocated by memdup_user |
| will not be freed. Pump index up so it will be freed. |
| |
| Fixes: 838bfa6049fb ("i2c-dev: Add support for I2C_M_RECV_LEN") |
| Signed-off-by: Yingjoe Chen <yingjoe.chen@mediatek.com> |
| Signed-off-by: Wolfram Sang <wsa@the-dreams.de> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/i2c/i2c-dev.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/i2c/i2c-dev.c |
| +++ b/drivers/i2c/i2c-dev.c |
| @@ -300,6 +300,7 @@ static noinline int i2cdev_ioctl_rdrw(st |
| rdwr_pa[i].buf[0] < 1 || |
| rdwr_pa[i].len < rdwr_pa[i].buf[0] + |
| I2C_SMBUS_BLOCK_MAX) { |
| + i++; |
| res = -EINVAL; |
| break; |
| } |
