i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

i2c bus_raw: fix passing cmdBuffer, handle large buffer size

Browse Source 
Change-Id: Ia2965d465899d087f0cbf8f7b07a7a326ed305db
Reviewed-on: https://review.haiku-os.org/c/haiku/+/2496
Reviewed-by: Jérôme Duval <[email protected]>
This commit is contained in:
X512
2020-04-20 14:56:16 +00:00
committed by Jérôme Duval
parent b29db8ebbb
commit 04ff1cfaef
1 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/bus_managers/i2c/bus_raw.cpp
+17 -5
View File
@@ -6,6 +6,8 @@
#include "I2CPrivate.h" #include "I2CPrivate.h"
#include <StackOrHeapArray.h>
static status_t static status_t
i2c_bus_raw_init(void* driverCookie, void **_cookie) i2c_bus_raw_init(void* driverCookie, void **_cookie)
@@ -64,14 +66,23 @@ i2c_bus_raw_control(void *_cookie, uint32 op, void *data, size_t length)
case I2CEXEC: case I2CEXEC:
{ {
i2c_ioctl_exec exec; i2c_ioctl_exec exec;
uint8 cmdBuffer[32];
uint8 buffer[32];
const void* userCmdBuffer = NULL; const void* userCmdBuffer = NULL;
void* userBuffer = NULL; void* userBuffer = NULL;
if (user_memcpy(&exec, data, sizeof(i2c_ioctl_exec)) != B_OK) if (user_memcpy(&exec, data, sizeof(i2c_ioctl_exec)) != B_OK)
return B_BAD_ADDRESS; return B_BAD_ADDRESS;
if (exec.cmdBuffer == NULL)
exec.cmdLength = 0;
if (exec.buffer == NULL)
exec.bufferLength = 0;
BStackOrHeapArray<uint8, 32> cmdBuffer(exec.cmdLength);
BStackOrHeapArray<uint8, 32> buffer(exec.bufferLength);
if (!cmdBuffer.IsValid() || !buffer.IsValid())
return B_NO_MEMORY;
if (exec.cmdBuffer != NULL) { if (exec.cmdBuffer != NULL) {
if (user_memcpy(cmdBuffer, exec.cmdBuffer, exec.cmdLength) if (!IS_USER_ADDRESS(exec.cmdBuffer)
|| user_memcpy(cmdBuffer, exec.cmdBuffer, exec.cmdLength)
!= B_OK) { != B_OK) {
return B_BAD_ADDRESS; return B_BAD_ADDRESS;
} }
@@ -79,7 +90,8 @@ i2c_bus_raw_control(void *_cookie, uint32 op, void *data, size_t length)
exec.cmdBuffer = cmdBuffer; exec.cmdBuffer = cmdBuffer;
} }
if (exec.buffer != NULL) { if (exec.buffer != NULL) {
if (user_memcpy(buffer, exec.buffer, exec.bufferLength) if (!IS_USER_ADDRESS(exec.buffer)
|| user_memcpy(buffer, exec.buffer, exec.bufferLength)
!= B_OK) { != B_OK) {
return B_BAD_ADDRESS; return B_BAD_ADDRESS;
} }
@@ -92,7 +104,7 @@ i2c_bus_raw_control(void *_cookie, uint32 op, void *data, size_t length)
return status; return status;
status = bus->ExecCommand(exec.op, exec.addr, status = bus->ExecCommand(exec.op, exec.addr,
&exec.cmdBuffer, exec.cmdLength, exec.buffer, exec.cmdBuffer, exec.cmdLength, exec.buffer,
exec.bufferLength); exec.bufferLength);
bus->ReleaseBus(); bus->ReleaseBus();