lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 157/389] HID: cp2112: prevent a buffer overflow in cp2112_xfer()
    Date
    From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>

    [ Upstream commit 381583845d19cb4bd21c8193449385f3fefa9caf ]

    Smatch warnings:
    drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy()
    'data->block[1]' too small (33 vs 255)
    drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too
    small (64 vs 255)

    The 'read_length' variable is provided by 'data->block[0]' which comes
    from user and it(read_length) can take a value between 0-255. Add an
    upper bound to 'read_length' variable to prevent a buffer overflow in
    memcpy().

    Fixes: 542134c0375b ("HID: cp2112: Fix I2C_BLOCK_DATA transactions")
    Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/hid/hid-cp2112.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
    index db1b55df0d13..340408f8c8ab 100644
    --- a/drivers/hid/hid-cp2112.c
    +++ b/drivers/hid/hid-cp2112.c
    @@ -787,6 +787,11 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
    data->word = le16_to_cpup((__le16 *)buf);
    break;
    case I2C_SMBUS_I2C_BLOCK_DATA:
    + if (read_length > I2C_SMBUS_BLOCK_MAX) {
    + ret = -EINVAL;
    + goto power_normal;
    + }
    +
    memcpy(data->block + 1, buf, read_length);
    break;
    case I2C_SMBUS_BLOCK_DATA:
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-23 13:29    [W:4.038 / U:0.400 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site