From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A01ABC433E0 for ; Mon, 29 Jun 2020 20:15:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7920F20656 for ; Mon, 29 Jun 2020 20:15:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1593461737; bh=Gm6NB5OaSRX0V3apjQo3zJ4NUY4P+FuV6gxdeznFVKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=lhr4u2tSRRNddTSd2F2d3mDT/qlDeCCY/SiJxJgtasQLUvgOjRhCw0UFvGqgoMwfJ OOqhRph8+LF6NptCq337GElRTNEpqRy2X3zTb35Ollmb3TuNYaqMa/0W0a31Byn+Wl a9RcFPjSGqShktgZU3vgMX+5vjp/q9e6ahsbumU4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730461AbgF2UPg (ORCPT ); Mon, 29 Jun 2020 16:15:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:40562 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732819AbgF2TaR (ORCPT ); Mon, 29 Jun 2020 15:30:17 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 13A4A2527B; Mon, 29 Jun 2020 15:36:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1593444987; bh=Gm6NB5OaSRX0V3apjQo3zJ4NUY4P+FuV6gxdeznFVKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ni8H6Nh2mNh+MpoZHBmrw9hCm2+831VE6TwAv8nMO3rLHTjmSKBSjS/DULb4mlmBG 4rLTWEfIeg4Ek7hhBhgG/Q+/sH73iKeeTKV6gx+V8WSp6WDwtluRtXveD2nPGAWTlz /UMtj+2BBkKCxDgFdLmq5s+o/bIPbyYS5WWRJzFU= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Mans Rullgard , Wolfram Sang , Sasha Levin Subject: [PATCH 4.19 087/131] i2c: core: check returned size of emulated smbus block read Date: Mon, 29 Jun 2020 11:34:18 -0400 Message-Id: <20200629153502.2494656-88-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200629153502.2494656-1-sashal@kernel.org> References: <20200629153502.2494656-1-sashal@kernel.org> MIME-Version: 1.0 X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.131-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-4.19.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 4.19.131-rc1 X-KernelTest-Deadline: 2020-07-01T15:34+00:00 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mans Rullgard [ Upstream commit 40e05200593af06633f64ab0effff052eee6f076 ] If the i2c bus driver ignores the I2C_M_RECV_LEN flag (as some of them do), it is possible for an I2C_SMBUS_BLOCK_DATA read issued on some random device to return an arbitrary value in the first byte (and nothing else). When this happens, i2c_smbus_xfer_emulated() will happily write past the end of the supplied data buffer, thus causing Bad Things to happen. To prevent this, check the size before copying the data block and return an error if it is too large. Fixes: 209d27c3b167 ("i2c: Emulate SMBus block read over I2C") Signed-off-by: Mans Rullgard [wsa: use better errno] Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/i2c-core-smbus.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c index 9cd66cabb84fd..8d6fad05b0c7f 100644 --- a/drivers/i2c/i2c-core-smbus.c +++ b/drivers/i2c/i2c-core-smbus.c @@ -497,6 +497,13 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr, break; case I2C_SMBUS_BLOCK_DATA: case I2C_SMBUS_BLOCK_PROC_CALL: + if (msg[1].buf[0] > I2C_SMBUS_BLOCK_MAX) { + dev_err(&adapter->dev, + "Invalid block size returned: %d\n", + msg[1].buf[0]); + status = -EPROTO; + goto cleanup; + } for (i = 0; i < msg[1].buf[0] + 1; i++) data->block[i] = msg[1].buf[i]; break; -- 2.25.1