diff options
| -rw-r--r-- | drivers/i2c/i2c-dev.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c index 64eee9551b22..df6e14c192d6 100644 --- a/drivers/i2c/i2c-dev.c +++ b/drivers/i2c/i2c-dev.c @@ -226,8 +226,10 @@ static int i2cdev_ioctl(struct inode *inode, struct file *file, res = 0; for( i=0; i<rdwr_arg.nmsgs; i++ ) { - /* Limit the size of the message to a sane amount */ - if (rdwr_pa[i].len > 8192) { + /* Limit the size of the message to a sane amount; + * and don't let length change either. */ + if ((rdwr_pa[i].len > 8192) || + (rdwr_pa[i].flags & I2C_M_RECV_LEN)) { res = -EINVAL; break; } |