lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 113/178] i2c: core: check returned size of emulated smbus block read
    Date
    From: Mans Rullgard <mans@mansr.com>

    [ Upstream commit 40e05200593af06633f64ab0effff052eee6f076 ]

    If the i2c bus driver ignores the I2C_M_RECV_LEN flag (as some of
    them do), it is possible for an I2C_SMBUS_BLOCK_DATA read issued
    on some random device to return an arbitrary value in the first
    byte (and nothing else). When this happens, i2c_smbus_xfer_emulated()
    will happily write past the end of the supplied data buffer, thus
    causing Bad Things to happen. To prevent this, check the size
    before copying the data block and return an error if it is too large.

    Fixes: 209d27c3b167 ("i2c: Emulate SMBus block read over I2C")
    Signed-off-by: Mans Rullgard <mans@mansr.com>
    [wsa: use better errno]
    Signed-off-by: Wolfram Sang <wsa@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/i2c/i2c-core-smbus.c | 7 +++++++
    1 file changed, 7 insertions(+)

    diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
    index 3ac426a8ab5ab..c2ae8c8cd4295 100644
    --- a/drivers/i2c/i2c-core-smbus.c
    +++ b/drivers/i2c/i2c-core-smbus.c
    @@ -495,6 +495,13 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
    break;
    case I2C_SMBUS_BLOCK_DATA:
    case I2C_SMBUS_BLOCK_PROC_CALL:
    + if (msg[1].buf[0] > I2C_SMBUS_BLOCK_MAX) {
    + dev_err(&adapter->dev,
    + "Invalid block size returned: %d\n",
    + msg[1].buf[0]);
    + status = -EPROTO;
    + goto cleanup;
    + }
    for (i = 0; i < msg[1].buf[0] + 1; i++)
    data->block[i] = msg[1].buf[i];
    break;
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-29 21:42    [W:4.102 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site