Messages in this thread | | | Date | Tue, 14 Mar 2023 18:05:54 +0100 | From | Andi Shyti <> | Subject | Re: [PATCH v4] i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() |
| |
Hi Wei,
On Tue, Mar 14, 2023 at 04:54:21PM +0000, Wei Chen wrote: > The data->block[0] variable comes from user and is a number between > 0-255. Without proper check, the variable may be very large to cause > an out-of-bounds when performing memcpy in slimpro_i2c_blkwr. > > Fix this bug by checking the value of writelen. > > Fixes: f6505fbabc42 ("i2c: add SLIMpro I2C device driver on APM X-Gene platform") > Signed-off-by: Wei Chen <harperchen1110@gmail.com> > Cc: stable@vger.kernel.org
and...
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Thanks, Andi
| |