From 17703916216102512fc7727e0d0fdfcfebd9ed00 Mon Sep 17 00:00:00 2001
From: jakllsch <jakllsch@NetBSD.org>
Date: Thu, 22 Jan 2015 17:56:35 +0000
Subject: [PATCH] =?UTF-8?q?More=20correctly=20handle=20I=C2=B2C=20exec=20i?=
 =?UTF-8?q?octls=20with=20both=20a=20command=20and=20write=20data=20phase.?=
 =?UTF-8?q?=20Previously=20the=20data=20phase=20of=20ioctl=20writes=20was?=
 =?UTF-8?q?=20sending=20uninitialized=20kernel=20stack=20to=20the=20addres?=
 =?UTF-8?q?sed=20device.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 sys/dev/i2c/i2c.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sys/dev/i2c/i2c.c b/sys/dev/i2c/i2c.c
index 177209b5571b..6e2358317bbb 100644
--- a/sys/dev/i2c/i2c.c
+++ b/sys/dev/i2c/i2c.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: i2c.c,v 1.45 2014/12/07 00:32:35 jmcneill Exp $	*/
+/*	$NetBSD: i2c.c,v 1.46 2015/01/22 17:56:35 jakllsch Exp $	*/
 
 /*
  * Copyright (c) 2003 Wasabi Systems, Inc.
@@ -40,7 +40,7 @@
 #endif
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i2c.c,v 1.45 2014/12/07 00:32:35 jmcneill Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i2c.c,v 1.46 2015/01/22 17:56:35 jakllsch Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -525,6 +525,13 @@ iic_ioctl_exec(struct iic_softc *sc, i2c_ioctl_exec_t *iie, int flag)
 		}
 	}
 
+	if (iie->iie_buf != NULL && I2C_OP_WRITE_P(iie->iie_op)) {
+		error = copyin(iie->iie_buf, buf, iie->iie_buflen);
+		if (error) {
+			return error;
+		}
+	}
+
 	iic_acquire_bus(ic, 0);
 	error = iic_exec(ic, iie->iie_op, iie->iie_addr, cmd, iie->iie_cmdlen,
 	    buf, iie->iie_buflen, 0);
@@ -542,7 +549,7 @@ iic_ioctl_exec(struct iic_softc *sc, i2c_ioctl_exec_t *iie, int flag)
 	if (error)
 		return error;
 
-	if (iie->iie_buf)
+	if (iie->iie_buf != NULL && I2C_OP_READ_P(iie->iie_op))
 		error = copyout(buf, iie->iie_buf, iie->iie_buflen);
 
 	return error;