From 203aebd3652f3ca89537466329d6f76ed40ff324 Mon Sep 17 00:00:00 2001 From: Asmaa Mnebhi Date: Tue, 7 May 2024 21:08:54 +0800 Subject: [PATCH] i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() stable inclusion from stable-v5.10.146 commit 48ee0a864d1af02eea98fc825cc230d61517a71e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9KHJ6 CVE: CVE-2022-48632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=48ee0a864d1af02eea98fc825cc230d61517a71e -------------------------------- [ Upstream commit de24aceb07d426b6f1c59f33889d6a964770547b ] memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments. Fixes: b5b5b32081cd206b ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC") Reviewed-by: Khalil Blaiech Signed-off-by: Asmaa Mnebhi Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Signed-off-by: Jialin Zhang Reviewed-by: Zheng Zengkai Signed-off-by: Liu Shixin --- drivers/i2c/busses/i2c-mlxbf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c index ab261d762dea..833c5ede863b 100644 --- a/drivers/i2c/busses/i2c-mlxbf.c +++ b/drivers/i2c/busses/i2c-mlxbf.c @@ -744,6 +744,9 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, if (flags & MLXBF_I2C_F_WRITE) { write_en = 1; write_len += operation->length; + if (data_idx + operation->length > + MLXBF_I2C_MASTER_DATA_DESC_SIZE) + return -ENOBUFS; memcpy(data_desc + data_idx, operation->buffer, operation->length); data_idx += operation->length; -- Gitee