linux-kernel - Re: [PATCH] HID: mcp2221: prevent a buffer overflow in mcp_smbus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <nycvar.YFH.7.76.2207211154580.19850@cbobk.fhfr.pm>
Date:   Thu, 21 Jul 2022 11:55:23 +0200 (CEST)
From:   Jiri Kosina <jikos@...nel.org>
To:     Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
cc:     dan.carpenter@...cle.com, Rishi Gupta <gupt21@...il.com>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        linux-i2c@...r.kernel.org, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] HID: mcp2221: prevent a buffer overflow in
 mcp_smbus_write()

On Mon, 20 Jun 2022, Harshit Mogalapalli wrote:

> Smatch Warning:
> drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy()
> '&mcp->txbuf[5]' too small (59 vs 255)
> drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() 'buf'
> too small (34 vs 255)
> 
> The 'len' variable can take a value between 0-255 as it can come from
> data->block[0] and it is user data. So add an bound check to prevent a
> buffer overflow in memcpy().
> 
> Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs