Skip to contentSkip to conversation

i2c: s3c24xx: check the size of the SMBUS message before using it

PATCH Applied Greg Kroah-Hartman 2 participants 3 messages Feb 23 – Mar 26

Subsystems (2)
Arm Samsung Exynos I2C subsystem host drivers
lore
Share & tools
lore

Greg Kroah-Hartman

author
#0 lore raw

PATCH 1/1 i2c: s3c24xx: check the size of the SMBUS message before using it

The first byte of an i2c SMBUS message is the size, and it should be verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX before processing it.

This is the same logic that was added in commit a6e04f05ce0b ("i2c:
tegra: check msg length in SMBUS block read") to the i2c tegra driver.

Cc Krzysztof Kozlowski <[email protected]>
Cc Alim Akhtar <[email protected]>
Cc Andi Shyti <[email protected]>
Cc stable <[email protected]>
Assisted-by gkh_clanker_2000
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/i2c/busses/i2c-s3c2410.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-s3c2410.c +6 -1
index 8138f5ef40f0..15e14a6fe6dc 100644
@@ -503,8 +503,13 @@ static void i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat)
 		i2c->msg->buf[i2c->msg_ptr++] = byte;
 
 		/* Add actual length to read for smbus block read */
-		if (i2c->msg->flags & I2C_M_RECV_LEN && i2c->msg->len == 1)
+		if (i2c->msg->flags & I2C_M_RECV_LEN && i2c->msg->len == 1) {
+			if (byte == 0 || byte > I2C_SMBUS_BLOCK_MAX) {
+				s3c24xx_i2c_stop(i2c, -EPROTO);
+				break;
+			}
 			i2c->msg->len += byte;
+		}
  prepare_read:
 		if (is_msglast(i2c)) {
 			/* last byte of buffer */
Signature · 1 line
2.53.0
maintainer Applied
#1 lore raw

Hi Greg,

Quoted 7 lines · Greg Kroah-Hartman

The first byte of an i2c SMBUS message is the size, and it should be verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX before processing it.

This is the same logic that was added in commit a6e04f05ce0b ("i2c:
tegra: check msg length in SMBUS block read") to the i2c tegra driver.

Quoted 6 lines
Cc Krzysztof Kozlowski <[email protected]>
Cc Alim Akhtar <[email protected]>
Cc Andi Shyti <[email protected]>
Cc stable <[email protected]>
Assisted-by gkh_clanker_2000
Signed-off-by Greg Kroah-Hartman <[email protected]>

merged to i2c/i2c-host.

Thanks,
Andi

author
#2 lore raw
Quoted 10 lines · Andi Shyti

Hi Greg,

Quoted 7 lines · Greg Kroah-Hartman

The first byte of an i2c SMBUS message is the size, and it should be verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX before processing it.

This is the same logic that was added in commit a6e04f05ce0b ("i2c:
tegra: check msg length in SMBUS block read") to the i2c tegra driver.

Quoted 8 lines
Quoted 6 lines
Cc Krzysztof Kozlowski <[email protected]>
Cc Alim Akhtar <[email protected]>
Cc Andi Shyti <[email protected]>
Cc stable <[email protected]>
Assisted-by gkh_clanker_2000
Signed-off-by Greg Kroah-Hartman <[email protected]>

merged to i2c/i2c-host.

Thanks!