Messages in this thread | | | Date | Thu, 16 Mar 2023 21:16:10 +0100 | From | Wolfram Sang <> | Subject | Re: [PATCH v4] i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() |
| |
On Tue, Mar 14, 2023 at 04:54:21PM +0000, Wei Chen wrote: > The data->block[0] variable comes from user and is a number between > 0-255. Without proper check, the variable may be very large to cause > an out-of-bounds when performing memcpy in slimpro_i2c_blkwr. > > Fix this bug by checking the value of writelen. > > Fixes: f6505fbabc42 ("i2c: add SLIMpro I2C device driver on APM X-Gene platform") > Signed-off-by: Wei Chen <harperchen1110@gmail.com> > Cc: stable@vger.kernel.org
Applied to for-current, thanks!
[unhandled content-type:application/pgp-signature] | |