summaryrefslogtreecommitdiffstats
path: root/drivers/i2c/i2c-dev.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* i2c: dev: prevent ZERO_SIZE_PTR deref in i2cdev_ioctl_rdwr()Alexander Popov2018-04-271-1/+1
| | | | | | | | | | | | | | | | | | i2cdev_ioctl_rdwr() allocates i2c_msg.buf using memdup_user(), which returns ZERO_SIZE_PTR if i2c_msg.len is zero. Currently i2cdev_ioctl_rdwr() always dereferences the buf pointer in case of I2C_M_RD | I2C_M_RECV_LEN transfer. That causes a kernel oops in case of zero len. Let's check the len against zero before dereferencing buf pointer. This issue was triggered by syzkaller. Signed-off-by: Alexander Popov <alex.popov@linux.com> Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> [wsa: use '< 1' instead of '!' for easier readability] Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c: dev: mark RDWR buffers as DMA_SAFEWolfram Sang2017-12-031-0/+2
| | | | | | Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c compat ioctls: move to ->compat_ioctl()Al Viro2017-09-201-88/+180
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* i2c: fix kernel memory disclosure in dev interfaceVlad Tsyrklevich2017-01-121-1/+1
| | | | | | | | | | i2c_smbus_xfer() does not always fill an entire block, allowing kernel stack memory disclosure through the temp variable. Clear it before it's read to. Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net> Signed-off-by: Wolfram Sang <wsa@the-dreams.de> Cc: stable@kernel.org
* i2c-dev: don't get i2c adapter via i2c_devviresh kumar2016-07-081-6/+1
| | | | | | | | | | | | | There is no code protecting i2c_dev to be freed after it is returned from i2c_dev_get_by_minor() and using it to access the value which we already have (minor) isn't safe really. Avoid using it and get the adapter directly from 'minor'. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by: Jean Delvare <jdelvare@suse.de> Tested-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c: dev: use after free in detachDan Carpenter2016-05-281-1/+1
| | | | | | | | | The call to put_i2c_dev() frees "i2c_dev" so there is a use after free when we call cdev_del(&i2c_dev->cdev). Fixes: d6760b14d4a1 ('i2c: dev: switch from register_chrdev to cdev API') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c: dev: don't start function name with 'return'Wolfram Sang2016-05-271-3/+3
| | | | | | | | I stumbled multiple times over 'return_i2c_dev', especially before the actual 'return res'. It makes the code hard to read, so reanme the function to 'put_i2c_dev' which also better matches 'get_free_i2c_dev'. Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c: dev: switch from register_chrdev to cdev APIErico Nunes2016-05-261-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | i2c-dev had never moved away from the older register_chrdev interface to implement its char device registration. The register_chrdev API has the limitation of enabling only up to 256 i2c-dev busses to exist. Large platforms with lots of i2c devices (i.e. pluggable transceivers) with dedicated busses may have to exceed that limit. In particular, there are also platforms making use of the i2c bus multiplexing API, which instantiates a virtual bus for each possible multiplexed selection. This patch removes the register_chrdev usage and replaces it with the less old cdev API, which takes away the 256 i2c-dev bus limitation. It should not have any other impact for i2c bus drivers or user space. This patch has been tested on qemu x86 and qemu powerpc platforms with the aid of a module which adds and removes 5000 virtual i2c busses, as well as validated on an existing powerpc hardware platform which makes use of the i2c bus multiplexing API. i2c-dev busses with device minor numbers larger than 256 have also been validated to work with the existing i2c-tools. Signed-off-by: Erico Nunes <erico.nunes@datacom.ind.br> [wsa: kept includes sorted] Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c: i2c-dev: sort includesWolfram Sang2016-02-201-7/+7
| | | | | | | I request this for drivers, so the core should adhere to sorted includes as well. Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c-dev: Fix I2C_SLAVE ioctl commentJean Delvare2015-10-231-10/+7
| | | | | | | | | | | The first part of the comment is wrong since November 2007, delete it. The second part of the comment is related to I2C_PEC, not I2C_SLAVE, so move it where it belongs. Signed-off-by: Jean Delvare <jdelvare@suse.de> Cc: Wolfram Sang <wsa@the-dreams.de> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c-dev: Fix typo in ioctl name referenceJean Delvare2015-10-231-3/+3
| | | | | | | | The ioctl is named I2C_RDWR for "I2C read/write". But references to it were misspelled "rdrw". Fix them. Signed-off-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* i2c: remove FSF addressWolfram Sang2014-11-071-5/+0
| | | | | | | We have a central copy of the GPL for that. Some addresses were already outdated. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
* i2c: i2c-dev: Create 'name' attribute automaticallyGuenter Roeck2013-09-301-9/+10
| | | | | | | | | | | The 'name' attribute is needed for all i2c-dev class devices, meaning it can be created automatically by pointing to it in the class data structure. This simplifies the code and reduces the probability for race conditions (the name attribute should exist by the time the device is announced to user space). Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
* new helper: file_inode(file)Al Viro2013-02-231-2/+2
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* i2c-dev: Add support for I2C_M_RECV_LENJean Delvare2012-05-301-4/+26
| | | | | | | | | | | | | | As the bus driver side implementation of I2C_M_RECV_LEN is heavily tied to SMBus, we can't support received length over 32 bytes, but let's at least support that. In practice, the caller will have to setup a buffer large enough to cover the case where received length byte has value 32, so minimum 32 + 1 = 33 bytes, possibly more if there is a fixed number of bytes added for the specific slave (for example a checksum.) Signed-off-by: Jean Delvare <khali@linux-fr.org> Tested-by: Douglas Gilbert <dgilbert@interlog.com>
* i2c: Update the FSF addressJean Delvare2012-03-261-1/+2
| | | | Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Use memdup_userThomas Meyer2012-01-121-9/+4
| | | | | | | | | | | | | | Use memdup_user rather than duplicating its implementation. This is a little bit restricted to reduce false positives. The semantic patch that makes this output is available in scripts/coccinelle/api/memdup_user.cocci. More information about semantic patching is available at http://coccinelle.lip6.fr/ Signed-off-by: Thomas Meyer <thomas@m3y3r.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Make i2cdev_notifier_call staticShubhrajyoti D2011-11-231-1/+1
| | | | | | | | | | | | The function i2cdev_notifier_call is used only in i2c-dev file making it static. Also removes the following sparse warning drivers/i2c/i2c-dev.c:582:5: warning: symbol 'i2cdev_notifier_call' was not declared. Should it be static? Signed-off-by: Shubhrajyoti D <shubhrajyoti@ti.com> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Use standard bus notification mechanismJean Delvare2011-03-201-21/+39
| | | | | | | | | Use the standard driver core mechanism to keep track of i2c adapters present on the system: i2c_for_each_dev and a notifier. This will let us deprecate and ultimately remove the legacy attach_adapter and detach_adapter callbacks in i2c_driver. Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Let i2c_parent_is_i2c_adapter return the parent adapterJean Delvare2010-10-241-7/+6
| | | | | | | This makes the calling site's code clearer IMHO. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Michael Lawnick <ml.lawnick@gmx.de>
* i2c: Multiplexed I2C bus core supportMichael Lawnick2010-08-111-1/+39
| | | | | | | | | Add multiplexed bus core support. I2C multiplexer and switches like pca954x get instantiated as new adapters per port. Signed-off-by: Michael Lawnick <ml.lawnick@gmx.de> Acked-by: Rodolfo Giometti <giometti@linux.it> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Use memdup_userJulia Lawall2010-08-111-16/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use memdup_user when user data is immediately copied into the allocated region. Note that in the second case, the ++i is no longer necessary, as the last value is already freed if needed by the call to memdup_user. The semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression from,to,size,flag; position p; identifier l1,l2; @@ - to = \(kmalloc@p\|kzalloc@p\)(size,flag); + to = memdup_user(from,size); if ( - to==NULL + IS_ERR(to) || ...) { <+... when != goto l1; - -ENOMEM + PTR_ERR(to) ...+> } - if (copy_from_user(to, from, size) != 0) { - <+... when != goto l2; - -EFAULT - ...+> - } // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Remove unnecessary kmalloc castsJoe Perches2010-08-111-3/+1
| | | | | Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Fix all coding style issuesFarid Hammane2010-05-211-15/+15
| | | | | | | Fix all coding style issues found by checkpatch.pl. Signed-off-by: Farid Hammane <farid.hammane@gmail.com> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Remove unnecessary castsH Hartley Sweeten2010-05-211-3/+3
| | | | | | | | The private_data member of struct file is a void *, there is no need to cast it. Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Remove big kernel lock from i2cdev_openVincent Sanders2009-12-061-16/+6
| | | | | | | | | | The BKL is held over a kmalloc so cannot protect anything beyond that. The two calls before the kmalloc have their own locking. Improve device open function by removing the now unnecessary ret variable Signed-off-by: Vincent Sanders <vince@simtec.co.uk> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Clarify the unit of ioctl I2C_TIMEOUTJean Delvare2009-02-241-1/+5
| | | | | | | | | | | The unit in which user-space can set the bus timeout value is jiffies for historical reasons (back when HZ was always 100.) This is however not good because user-space doesn't know how long a jiffy lasts. The timeout value should instead be set in a fixed time unit. Given the original value of HZ, this unit should be 10 ms, for compatibility. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: Wolfram Sang <w.sang@pengutronix.de>
* device create: misc: convert device_create_drvdata to device_createGreg Kroah-Hartman2008-10-161-3/+3
| | | | | | | | Now that device_create() has been audited, rename things back to the original call to be sane. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* i2c-dev: Return correct error code on class_create() failureSven Wegener2008-09-241-1/+3
| | | | | | | | We need to convert the error pointer from class_create(), else we'll return the successful return code from register_chrdev() on failure. Signed-off-by: Sven Wegener <sven.wegener@stealer.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: correct some size_t printk formatsDavid Brownell2008-08-101-2/+2
| | | | | | | | | Fix various printk format strings where %zd was passed a size_t; those should be %zu instead. (Courtesy of a version of GCC which warns when these details are wrong.) Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* device create: i2c: convert device_create to device_create_drvdataGreg Kroah-Hartman2008-07-221-3/+3
| | | | | | | | device_create() is race-prone, so use the race-free device_create_drvdata() instead as device_create() is going away. Cc: Jean Delvare <khali@linux-fr.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* Merge branch 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6Linus Torvalds2008-07-151-10/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6: (56 commits) i2c: Add detection capability to new-style drivers i2c: Call client_unregister for new-style devices too i2c: Clean up old chip drivers i2c-ibm_iic: Register child nodes i2c: New-style EEPROM driver using device IDs i2c: Export the i2c_bus_type symbol i2c-au1550: Fix PM support i2c-dev: Delete empty detach_client callback i2c: Drop stray references to lm_sensors i2c: Check for ACPI resource conflicts i2c-ocores: basic PM support i2c-sibyte: SWARM I2C board initialization i2c-i801: Fix handling of error conditions i2c-i801: Rename local variable temp to status i2c-i801: Properly report bus arbitration loss i2c-i801: Remove verbose debugging messages i2c-algo-pcf: Drop unused struct members i2c-algo-pcf: Multi-master lost-arbitration improvement i2c: Deprecate the legacy gpio drivers i2c-pxa: Initialize early ...
| * i2c-dev: Delete empty detach_client callbackJean Delvare2008-07-141-7/+0
| | | | | | | | | | | | | | | | | | Implementing detach_client is optional, so there is no point in an empty implementation. Likewise, i2c driver IDs are optional, and we don't need one. Signed-off-by: Jean Delvare <khali@linux-fr.org>
| * i2c: Push ioctl BKL down into the i2c codeAlan Cox2008-07-141-3/+2
| | | | | | | | | | | | | | | | | | | | This is part of the effort to get rid of the BKL. [JD: In fact i2c-dev doesn't need more locking than is already done for the other i2c drivers, so we can simply switch to unlocked_ioctl.] Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* | i2c: cdev lock_kernel() pushdownJonathan Corbet2008-05-181-6/+16
|/ | | | Signed-off-by: Jonathan Corbet <corbet@lwn.net>
* i2c-dev: Split i2cdev_ioctlJean Delvare2008-04-221-161/+168
| | | | | | | | Split the handling of the I2C_RDWR and I2C_SMBUS ioctls to their own functions. This limits the stack usage, saves one level of indentation and makes the code more readable. Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Stop using the redundant client listDavid Brownell2008-01-271-17/+12
| | | | | | | | | | | | | | | | | | | | | | | | | The i2c_adapter.clients list of i2c_client nodes duplicates driver model state. This patch starts removing that list, letting us remove most existing users of those i2c-core lists. * The core I2C code now iterates over the driver model's list instead of the i2c-internal one in some places where it's safe: - Passing a command/ioctl to each client, a mechanims used almost exclusively by DVB adapters; - Device address checking, in both i2c-core and i2c-dev. * Provide i2c_verify_client() to use with driver model iterators. * Flag the relevant i2c_adapter and i2c_client fields as deprecated, to help prevent new users from appearing. For the moment the list needs to stick around, since some issues show up when deleting devices created by legacy I2C drivers. (They don't follow standard driver model rules. Removing those devices can cause self-deadlocks.) Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Spelling fixesJoe Perches2008-01-141-1/+1
| | | | | | | [JD: One more fix in i2c-dev.] Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Unbound new-style i2c clients aren't busyJean Delvare2007-11-151-1/+25
| | | | | | | | | | | | | Let i2c-dev deal properly with new-style i2c clients. Instead of considering them always busy, it needs to check wether a driver is bound to them or not. This is still not completely correct, as the client could become busy later, but the same problem already existed before new-style clients were introduced. We'll want to fix it someday. Signed-off-by: Jean Delvare <khali@linux-fr.org> Acked-by: David Brownell <dbrownell@users.sourceforge.net>
* i2c-dev: "how does it work" commentsDavid Brownell2007-11-151-1/+59
| | | | | | | | | | | | | | | | | | | | | | | | | This adds some "how does this work" comments to the i2c-dev driver, plus separators between the three main components: - The parallel list of i2c_adapters ("i2c_dev_list"), each of which gets a "struct i2c_dev" and a /dev/i2c-X character special file. - An i2cdev_driver gets adapter add/remove notifications, which are used to maintain that list of adapters. - Special file operations, which let userspace talk either directly to the adapter (for i2c_msg operations) or through cached addressing info using an anonymous i2c_client (never registered anywhere). Plus there's the usual module load/unload record keeping. After making sense of this code, I think that the anonymous i2c_client is pretty shady. But since it's never registered, using this code with a system set up for "new style" I2C drivers is no more complicated than always using the I2C_SLAVE_FORCE ioctl (instead of I2C_SLAVE). Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Remove i2c_algorithm.algo_control()David Brownell2007-10-131-2/+12
| | | | | | | | | | | | | | | | | | This removes: - An effectively unused hook: i2c_algorithm.algo_control. - The i2c_control() call, used only by i2c-dev to call that unused hook or set two barely supported adapter params. (That param setting moves into i2c-dev.c ... still iffy due to lack of locking, but no other changes.) As shown by diffstat, this is a net code shrink. It also reduces the complexity of the I2C adapter and /dev interfaces. Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c-dev: Reject I2C_M_RECV_LENDavid Brownell2007-10-131-2/+4
| | | | | | | | | | | | The I2C_M_RECV_LEN calling convention for i2c_mesg.flags involves playing games with reported buffer lengths. (They start out less than their actual size, and the length is then modified to reflect how many bytes were delivered ... which one hopes is less than the presumed actual size.) Refuse to play such error prone games across the boundary between userspace and kernel. Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Fix the i2c_smbus_read_i2c_block_data() prototypeJean Delvare2007-07-121-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Let the drivers specify how many bytes they want to read with i2c_smbus_read_i2c_block_data(). So far, the block count was hard-coded to I2C_SMBUS_BLOCK_MAX (32), which did not make much sense. Many driver authors complained about this before, and I believe it's about time to fix it. Right now, authors have to do technically stupid things, such as individual byte reads or full-fledged I2C messaging, to work around the problem. We do not want to encourage that. I even found that some bus drivers (e.g. i2c-amd8111) already implemented I2C block read the "right" way, that is, they didn't follow the old, broken standard. The fact that it was never noticed before just shows how little i2c_smbus_read_i2c_block_data() was used, which isn't that surprising given how broken its prototype was so far. There are some obvious compatiblity considerations: * This changes the i2c_smbus_read_i2c_block_data() prototype. Users outside the kernel tree will notice at compilation time, and will have to update their code. * User-space has access to i2c_smbus_xfer() directly using i2c-dev, so the changed expectations would affect tools such as i2cdump. In order to preserve binary compatibility, we give I2C_SMBUS_I2C_BLOCK_DATA a new numeric value, and define I2C_SMBUS_I2C_BLOCK_BROKEN with the old numeric value. When i2c-dev receives a transaction with the old value, it can convert it to the new format on the fly. Signed-off-by: Jean Delvare <khali@linux-fr.org>
* header cleaning: don't include smp_lock.h when not usedRandy Dunlap2007-05-081-1/+0
| | | | | | | | | | | | Remove includes of <linux/smp_lock.h> where it is not used/needed. Suggested by Al Viro. Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc, sparc64, and arm (all 59 defconfigs). Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* [PATCH] mark struct file_operations const 3Arjan van de Ven2007-02-121-1/+1
| | | | | | | | | | | Many struct file_operations in the kernel can be "const". Marking them const moves these to the .rodata section, which avoids false sharing with potential dirty data. In addition it'll catch accidental writes at compile time to these shared resources. Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* i2c: Refactor a kfree in i2c-devJean Delvare2006-12-101-2/+1
| | | | | | | | | Refactor kfree(i2c_dev) into return_i2c_dev(). This saves some code and makes more sense, as the memory is allocated in get_free_i2c_dev(). Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: Greg Kroah-Hartman <gregkh@suse.de>
* i2c: Fix return value check in i2c-devAkinobu Mita2006-12-101-2/+2
| | | | | | | | | device_create() returns error code as pointer on failures. This patch checks the return value of device_create() by using IS_ERR(). Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Cc: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Whitespace cleanupsDavid Brownell2006-12-101-17/+17
| | | | | | | | Remove extraneous whitespace from various i2c headers and core files, like space-before-tab and whitespace at end of line. Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jean Delvare <khali@linux-fr.org>
* i2c: Use put_user instead of copy_to_user where possibleJean Delvare2006-12-101-2/+1
| | | | | | | This speeds up the I2C_FUNCS ioctl by 5 to 8% in my tests. Signed-off-by: Jean Delvare <khali@linux-fr.org> Laughed-at-by: Mark M. Hoffman <mhoffman@lightlink.com>
* [PATCH] struct path: convert i2c-driversJosef Sipek2006-12-081-2/+2
| | | | | | Signed-off-by: Josef Sipek <jsipek@fsl.cs.sunysb.edu> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 11:20:27 +0100