Re: i2c device driver bugs

["Shaun Colley" <shaunige@yahoo.co.uk>]

Hi Greg,

> Please let us know exactly what kernel version you
> see this in.  It
> looks to me that it is fixed in the latest 2.4 and
> 2.6 versions.  If you
> do not think so, please let us know.

I was actually looking at a fairly old version of the
source tree (2.4.19, 2.4.20) -- it appears that a
quick fix fixed this vulnerability in 2.4.21:

http://lxr.linux.no/diff/drivers/i2c/i2c-dev.c?diffval=2.4.21;diffvar=v

If you scroll down a bit, you should see:

---
if (rdwr_arg.nmsgs > 42)
          return -EINVAL;
---

It looks like a quick sanity check was added in the
'I2C_RDWR' option, to fix the issue.

I'm downloading the 2.4.21 patch to check if the
fixing of this was recorded, or whether it was
silently fixed (looks like it was).

Confirmed.  2.4.21 fixed the bug:

---
[shaun@cpc2-mars1-3-0-cust191 shaun]$ grep -n -A 10
"sent at once" * 
patch-2.4.21:162276:+		 * be sent at once */
patch-2.4.21-162277-+		if (rdwr_arg.nmsgs > 42)
patch-2.4.21-162278-+			return -EINVAL;
patch-2.4.21-162279-+		
patch-2.4.21-162280- 		rdwr_pa = (struct i2c_msg *)
patch-2.4.21-162281- 			kmalloc(rdwr_arg.nmsgs *
sizeof(struct i2c_msg), 
patch-2.4.21-162282- 			GFP_KERNEL);
patch-2.4.21-162283-@@ -270,6 +275,11 @@
patch-2.4.21-162284- 			        res = -EFAULT;
patch-2.4.21-162285- 				break;
patch-2.4.21-162286- 			}
[shaun@cpc2-mars1-3-0-cust191 shaun]$ 
---


It's also fixed in all versions of 2.6...

However, the vulnerbility seems to still be present in
2.5 -- latest version.  

So, to sum it up:

- Not present in 2.2, because the driver wasn't
implemented as fully as it is now.
- Present in 2.4 versions 2.4.20 and below.
- Present in 2.5
- Not present in 2.6



As for the second bug, it's fixed in 2.4.9, 2.5, and
2.6.



Thank you for your time.
Shaun.



	
	
		
___________________________________________________________ALL-NEW Yahoo! Messenger - sooooo many all-new ways to express yourself http://uk.messenger.yahoo.com