From: David Brownell <david-b@pacbell.net>
Subject: i2c-dev rejects I2C_M_RECV_LEN

The I2C_M_RECV_LEN calling convention for i2c_mesg.flags involves
playing games with reported buffer lengths.  (They start out less
than their actual size, and the length is then modified to reflect
how many bytes were delivered ... which one hopes is less than the
presumed actual size.)  Refuse to play such error prone games across
the boundary between userspace and kernel.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
---
 drivers/i2c/i2c-dev.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.23-rc8.orig/drivers/i2c/i2c-dev.c	2007-09-28 09:28:51.000000000 +0200
+++ linux-2.6.23-rc8/drivers/i2c/i2c-dev.c	2007-09-28 09:44:25.000000000 +0200
@@ -226,8 +226,10 @@ static int i2cdev_ioctl(struct inode *in
 
 		res = 0;
 		for( i=0; i<rdwr_arg.nmsgs; i++ ) {
-			/* Limit the size of the message to a sane amount */
-			if (rdwr_pa[i].len > 8192) {
+			/* Limit the size of the message to a sane amount;
+			 * and don't let length change either. */
+			if ((rdwr_pa[i].len > 8192) ||
+			    (rdwr_pa[i].flags & I2C_M_RECV_LEN)) {
 				res = -EINVAL;
 				break;
 			}