Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang: "Two bugfixes for the I2C core: Lixing Wang fixed a refcounting problem with DT nodes. Jeremy Compostella fixed a buffer overflow possibility when using a 'don't use' ioctl interface directly" * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA i2c: core: decrease reference count of device node in i2c_unregister_device
This commit is contained in:
commit
9bdbaeba93
|
@ -821,8 +821,12 @@ void i2c_unregister_device(struct i2c_client *client)
|
|||
{
|
||||
if (!client)
|
||||
return;
|
||||
if (client->dev.of_node)
|
||||
|
||||
if (client->dev.of_node) {
|
||||
of_node_clear_flag(client->dev.of_node, OF_POPULATED);
|
||||
of_node_put(client->dev.of_node);
|
||||
}
|
||||
|
||||
if (ACPI_COMPANION(&client->dev))
|
||||
acpi_device_clear_enumerated(ACPI_COMPANION(&client->dev));
|
||||
device_unregister(&client->dev);
|
||||
|
|
|
@ -397,16 +397,17 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
|
|||
the underlying bus driver */
|
||||
break;
|
||||
case I2C_SMBUS_I2C_BLOCK_DATA:
|
||||
if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {
|
||||
dev_err(&adapter->dev, "Invalid block %s size %d\n",
|
||||
read_write == I2C_SMBUS_READ ? "read" : "write",
|
||||
data->block[0]);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (read_write == I2C_SMBUS_READ) {
|
||||
msg[1].len = data->block[0];
|
||||
} else {
|
||||
msg[0].len = data->block[0] + 1;
|
||||
if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {
|
||||
dev_err(&adapter->dev,
|
||||
"Invalid block write size %d\n",
|
||||
data->block[0]);
|
||||
return -EINVAL;
|
||||
}
|
||||
for (i = 1; i <= data->block[0]; i++)
|
||||
msgbuf0[i] = data->block[i];
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue