lkml.org 
[lkml]   [2022]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 136/141] i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
    Date
    From: Asmaa Mnebhi <asmaa@nvidia.com>

    [ Upstream commit de24aceb07d426b6f1c59f33889d6a964770547b ]

    memcpy() is called in a loop while 'operation->length' upper bound
    is not checked and 'data_idx' also increments.

    Fixes: b5b5b32081cd206b ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
    Reviewed-by: Khalil Blaiech <kblaiech@nvidia.com>
    Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
    Signed-off-by: Wolfram Sang <wsa@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/i2c/busses/i2c-mlxbf.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c
    index 042c83b90734..d78fb24d5588 100644
    --- a/drivers/i2c/busses/i2c-mlxbf.c
    +++ b/drivers/i2c/busses/i2c-mlxbf.c
    @@ -744,6 +744,9 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv,
    if (flags & MLXBF_I2C_F_WRITE) {
    write_en = 1;
    write_len += operation->length;
    + if (data_idx + operation->length >
    + MLXBF_I2C_MASTER_DATA_DESC_SIZE)
    + return -ENOBUFS;
    memcpy(data_desc + data_idx,
    operation->buffer, operation->length);
    data_idx += operation->length;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-09-26 14:29    [W:4.177 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site