linux-kernel - [PATCH] i2c: dev: Block zero-length messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250822020951.919822-1-lizhi.xu@windriver.com>
Date: Fri, 22 Aug 2025 10:09:51 +0800
From: Lizhi Xu <lizhi.xu@...driver.com>
To: <syzbot+d99f3a288cc7d8ef60fb@...kaller.appspotmail.com>
CC: <linux-kernel@...r.kernel.org>, <linux-media@...r.kernel.org>,
        <mchehab@...nel.org>, <micha@...edict.org>,
        <syzkaller-bugs@...glegroups.com>
Subject: [PATCH] i2c: dev: Block zero-length messages

The user passed two messages via ioctl, both of which were zero-length.
This caused i2cdev_ioctl_rdwr() to allocate zero-length memory for msgs[i].buf
when executing memdup_user(), resulting in a ZERO_SIZE_PTR.
i2cdev_ioctl_rdwr() did not handle this situation, leading to a null-ptr-deref
when accessing msgs[i].buf in su3000_i2c_transfer().

Adding a zero-length check in i2cdev_ioctl_rdwr() resolves the ZERO_SIZE_PTR
issue.

Reported-by: syzbot+d99f3a288cc7d8ef60fb@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d99f3a288cc7d8ef60fb
Tested-by: syzbot+d99f3a288cc7d8ef60fb@...kaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizhi.xu@...driver.com>
---
 drivers/i2c/i2c-dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index e9577f920286..17b0bec53e21 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -257,7 +257,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
 	res = 0;
 	for (i = 0; i < nmsgs; i++) {
 		/* Limit the size of the message to a sane amount */
-		if (msgs[i].len > 8192) {
+		if (msgs[i].len > 8192 || msgs[i].len == 0) {
 			res = -EINVAL;
 			break;
 		}
-- 
2.43.0