linux-kernel - Re: [PATCH i2c-host-fixes v4 1/5] i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aJeGvoSYS5Raqxyk@shikoro>
Date: Sat, 9 Aug 2025 19:34:54 +0200
From: Wolfram Sang <wsa+renesas@...g-engineering.com>
To: Sven Eckelmann <sven@...fation.org>
Cc: Chris Packham <chris.packham@...iedtelesis.co.nz>,
	Andi Shyti <andi.shyti@...nel.org>, linux-i2c@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Jonas Jelonek <jelonek.jonas@...il.com>,
	Harshal Gohel <hg@...onwunderlich.de>,
	Simon Wunderlich <sw@...onwunderlich.de>,
	Alex Guo <alexguo1023@...il.com>, stable@...r.kernel.org
Subject: Re: [PATCH i2c-host-fixes v4 1/5] i2c: rtl9300: Fix out-of-bounds
 bug in rtl9300_i2c_smbus_xfer

On Sat, Aug 09, 2025 at 08:40:54AM +0200, Sven Eckelmann wrote:
> From: Alex Guo <alexguo1023@...il.com>
> 
> The data->block[0] variable comes from user. Without proper check,
> the variable may be very large to cause an out-of-bounds bug.
> 
> Fix this bug by checking the value of data->block[0] first.
> 
> 1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in
>    ismt_access()")
> 2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in
>    xgene_slimpro_i2c_xfer()")
> 
> Cc: <stable@...r.kernel.org>
> Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller")
> Signed-off-by: Alex Guo <alexguo1023@...il.com>
> Reviewed-by: Chris Packham <chris.packham@...iedtelesis.co.nz>
> Tested-by: Chris Packham <chris.packham@...iedtelesis.co.nz>
> Signed-off-by: Sven Eckelmann <sven@...fation.org>

Reviewed-by: Wolfram Sang <wsa+renesas@...g-engineering.com>


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)