From: Greg KH <greg@kroah.com>
To: Connor O'Brien <connoro@google.com>
Cc: stable@vger.kernel.org,
Jeremy Compostella <jeremy.compostella@intel.com>,
Wolfram Sang <wsa@the-dreams.de>,
stable@kernel.org
Subject: Re: [PATCH] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
Date: Wed, 3 Apr 2019 16:06:52 +0200 [thread overview]
Message-ID: <20190403140652.GF8633@kroah.com> (raw)
In-Reply-To: <20190401205441.65245-1-connoro@google.com>
On Mon, Apr 01, 2019 at 01:54:41PM -0700, Connor O'Brien wrote:
> From: Jeremy Compostella <jeremy.compostella@intel.com>
>
> commit 89c6efa61f5709327ecfa24bff18e57a4e80c7fa upstream.
>
> On a I2C_SMBUS_I2C_BLOCK_DATA read request, if data->block[0] is
> greater than I2C_SMBUS_BLOCK_MAX + 1, the underlying I2C driver writes
> data out of the msgbuf1 array boundary.
>
> It is possible from a user application to run into that issue by
> calling the I2C_SMBUS ioctl with data.block[0] greater than
> I2C_SMBUS_BLOCK_MAX + 1.
>
> This patch makes the code compliant with
> Documentation/i2c/dev-interface by raising an error when the requested
> size is larger than 32 bytes.
>
> Call Trace:
> [<ffffffff8139f695>] dump_stack+0x67/0x92
> [<ffffffff811802a4>] panic+0xc5/0x1eb
> [<ffffffff810ecb5f>] ? vprintk_default+0x1f/0x30
> [<ffffffff817456d3>] ? i2cdev_ioctl_smbus+0x303/0x320
> [<ffffffff8109a68b>] __stack_chk_fail+0x1b/0x20
> [<ffffffff817456d3>] i2cdev_ioctl_smbus+0x303/0x320
> [<ffffffff81745aed>] i2cdev_ioctl+0x4d/0x1e0
> [<ffffffff811f761a>] do_vfs_ioctl+0x2ba/0x490
> [<ffffffff81336e43>] ? security_file_ioctl+0x43/0x60
> [<ffffffff811f7869>] SyS_ioctl+0x79/0x90
> [<ffffffff81a22e97>] entry_SYSCALL_64_fastpath+0x12/0x6a
>
> Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
> Cc: stable@kernel.org
> [connoro@google.com: 4.9 backport: adjust filename]
> Signed-off-by: Connor O'Brien <connoro@google.com>
> ---
> drivers/i2c/i2c-core.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
Thanks for these, now applied.
greg k-h
next prev parent reply other threads:[~2019-04-03 14:06 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-01 20:54 [PATCH] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA Connor O'Brien
2019-04-03 14:06 ` Greg KH [this message]
-- strict thread matches above, loose matches on Subject: below --
2019-04-01 20:54 Connor O'Brien
2019-04-01 20:54 Connor O'Brien
2017-11-15 19:54 Compostella, Jeremy
2017-11-27 18:38 ` Wolfram Sang
2017-11-27 19:14 ` Compostella, Jeremy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190403140652.GF8633@kroah.com \
--to=greg@kroah.com \
--cc=connoro@google.com \
--cc=jeremy.compostella@intel.com \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
--cc=wsa@the-dreams.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.