| Message ID | 20250615234919.525431-1-alexguo1023@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | i2c: busses: Fix out-of-bounds bug in mchp_corei2c_smbus_xfer | expand |
diff --git a/drivers/i2c/busses/i2c-microchip-corei2c.c b/drivers/i2c/busses/i2c-microchip-corei2c.c index 492bf4c34722..a79d4d327f20 100644 --- a/drivers/i2c/busses/i2c-microchip-corei2c.c +++ b/drivers/i2c/busses/i2c-microchip-corei2c.c @@ -492,6 +492,8 @@ static int mchp_corei2c_smbus_xfer(struct i2c_adapter *adap, u16 addr, unsigned if (read_write == I2C_SMBUS_WRITE) { int data_len; + if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) + return -EINVAL; data_len = data->block[0]; msgs[CORE_I2C_SMBUS_MSG_WR].len = data_len + 2; for (int i = 0; i <= data_len; i++)
The data->block[0] variable comes from user. Without proper check, the variable may be very large to cause an out-of-bounds bug. Fix this bug by checking the value of data->block[0] first. Similar commit: 1. commit 39244cc7548 ("i2c: ismt: Fix an out-of-bounds bug in ismt_access()") 2. commit 92fbb6d1296 ("i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()") Signed-off-by: Alex Guo <alexguo1023@gmail.com> --- drivers/i2c/busses/i2c-microchip-corei2c.c | 2 ++ 1 file changed, 2 insertions(+)