git.openwrt.org Git - openwrt/openwrt.git/blob

   1 From 57f312b955938fc4663f430cb57a71f2414f601b Mon Sep 17 00:00:00 2001
   2 From: Alex Guo <alexguo1023@gmail.com>
   3 Date: Sun, 10 Aug 2025 20:05:13 +0200
   4 Subject: [PATCH] i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer
   5
   6 The data->block[0] variable comes from user. Without proper check,
   7 the variable may be very large to cause an out-of-bounds bug.
   8
   9 Fix this bug by checking the value of data->block[0] first.
  10
  11 1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in
  12    ismt_access()")
  13 2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in
  14    xgene_slimpro_i2c_xfer()")
  15
  16 Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller")
  17 Signed-off-by: Alex Guo <alexguo1023@gmail.com>
  18 Cc: <stable@vger.kernel.org> # v6.13+
  19 Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
  20 Tested-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
  21 Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
  22 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  23 Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
  24 Link: https://lore.kernel.org/r/20250810-i2c-rtl9300-multi-byte-v5-1-cd9dca0db722@narfation.org
  25
  26 diff --git a/drivers/i2c/busses/i2c-rtl9300.c b/drivers/i2c/busses/i2c-rtl9300.c
  27 index e064e8a4a1f0..568495720810 100644
  28 --- a/drivers/i2c/busses/i2c-rtl9300.c
  29 +++ b/drivers/i2c/busses/i2c-rtl9300.c
  30 @@ -281,6 +281,10 @@ static int rtl9300_i2c_smbus_xfer(struct i2c_adapter *adap, u16 addr, unsigned s
  31                 ret = rtl9300_i2c_reg_addr_set(i2c, command, 1);
  32                 if (ret)
  33                         goto out_unlock;
  34 +               if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) {
  35 +                       ret = -EINVAL;
  36 +                       goto out_unlock;
  37 +               }
  38                 ret = rtl9300_i2c_config_xfer(i2c, chan, addr, data->block[0]);
  39                 if (ret)
  40                         goto out_unlock;
  41 --
  42 2.48.1
  43