i2c: dev: copy userspace array safely

i2c-dev.c utilizes memdup_user() to copy a userspace array. This is done
without an overflow check.

Use the new wrapper memdup_array_user() to copy the array more safely.

Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index a91201509bc169a387d5b94289e10946f7de329a..8b7e599f167411be1cc8bc63e2e4c8f5b45059bc 100644 (file)
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -450,8 +450,8 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
                        return -EINVAL;
 
-               rdwr_pa = memdup_user(rdwr_arg.msgs,
-                                     rdwr_arg.nmsgs * sizeof(struct i2c_msg));
+               rdwr_pa = memdup_array_user(rdwr_arg.msgs,
+                                           rdwr_arg.nmsgs, sizeof(struct i2c_msg));
                if (IS_ERR(rdwr_pa))
                        return PTR_ERR(rdwr_pa);